{"id":41614,"date":"2020-02-13T20:48:26","date_gmt":"2020-02-13T17:48:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov"},"modified":"2020-02-13T20:48:26","modified_gmt":"2020-02-13T17:48:26","slug":"ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","title":{"rendered":"V\u00e2n\u0103toare de tehnici \u0219i tactici de atac folosind fi\u0219iere Prefetch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"V\u00e2n\u0103toare
\n
\nFi\u0219ierele de trasare, sau fi\u0219ierele Prefetch, au ap\u0103rut \u00een Windows \u00eenc\u0103 din timpul versiunii XP. De atunci, au ajutat speciali\u0219tii \u00een criminalistica digital\u0103 \u0219i reac\u021bia la incidentele informatic\u0103 s\u0103 g\u0103seasc\u0103 urme ale lans\u0103rii programelor, inclusiv a celor mali\u021bioase. Specialistul principal \u00een criminalistic\u0103 informatic\u0103 de la Group-IB Oleg Skulkin<\/b> explic\u0103 ce se poate g\u0103si prin intermediul fi\u0219ierelor Prefetch \u0219i cum se poate face acest lucru.<\/a><\/noindex><\/p>\n

Fi\u0219ierele Prefetch sunt stocate \u00een directorul %SystemRoot%Prefetch<\/b> \u0219i servesc la accelerarea procesului de lansare a programelor. Dac\u0103 ne uit\u0103m la oricare dintre aceste fi\u0219iere, vom observa c\u0103 numele s\u0103u este format din dou\u0103 p\u0103r\u021bi: numele fi\u0219ierului executabil \u0219i o sum\u0103 de control a c\u0103ii c\u0103tre acesta, format\u0103 din opt simboluri.<\/p>\n

Fi\u0219ierele Prefetch con\u021bin o mul\u021bime de informa\u021bii utile din punct de vedere criminalistic: numele fi\u0219ierului executabil, num\u0103rul de lans\u0103ri, liste de fi\u0219iere \u0219i directoare cu care a interac\u021bionat fi\u0219ierul executabil \u0219i, desigur, timpii de acces. De obicei, exper\u021bii \u00een criminalistic\u0103 folosesc data cre\u0103rii unui anumit fi\u0219ier Prefetch pentru a determina data primei lans\u0103ri a programului. \u00cen plus, aceste fi\u0219iere p\u0103streaz\u0103 data ultimei lans\u0103ri, iar \u00eencep\u00e2nd cu versiunea 26 (Windows 8.1) \u2014 timpii pentru ultimele \u0219apte lans\u0103ri.<\/p>\n

S\u0103 lu\u0103m unul dintre fi\u0219ierele Prefetch, s\u0103 extragem datele din acesta folosind PECmd de Eric Zimmermann \u0219i s\u0103 ne uit\u0103m la fiecare parte a acestora. Pentru demonstra\u021bie, voi extrage date din fi\u0219ierul CCLEANER64.EXE-DE05DBE1.pf<\/b>.<\/p>\n

A\u0219adar, s\u0103 \u00eencepem de sus. Desigur, avem timpii de creare, modificare \u0219i acces la fi\u0219ier:<\/p>\n

\"V\u00e2n\u0103toare
\nUrmeaz\u0103 numele fi\u0219ierului executabil, suma de control a c\u0103ii c\u0103tre acesta, dimensiunea fi\u0219ierului executabil, precum \u0219i versiunea fi\u0219ierului Prefetch:<\/p>\n

\"V\u00e2n\u0103toare
\nDeoarece avem de-a face cu Windows 10, apoi vom vedea num\u0103rul de lans\u0103ri, data \u0219i ora ultimei lans\u0103ri \u0219i \u00eenc\u0103 \u0219apte timpi de acces, care indic\u0103 datele anterioare de lansare:<\/p>\n

\"V\u00e2n\u0103toare
\nUrmeaz\u0103 informa\u021biile despre volum, inclusiv num\u0103rul s\u0103u de serie \u0219i data crea\u021biei:<\/p>\n

\"V\u00e2n\u0103toare
\n\u0218i \u00een cele din urm\u0103, dar nu mai pu\u021bin important \u2014 lista directoarelor \u0219i fi\u0219ierelor cu care a interac\u021bionat fi\u0219ierul executabil: <\/p>\n

\"V\u00e2n\u0103toare
\nA\u0219adar, directoarele \u0219i fi\u0219ierele cu care a interac\u021bionat fi\u0219ierul executabil sunt exact acelea pe care doresc s\u0103 m\u0103 concentrez ast\u0103zi. Aceste date le permit speciali\u0219tilor \u00een criminalistica digital\u0103, r\u0103spunsul la incidentele informatice sau c\u0103utarea proactiv\u0103 a amenin\u021b\u0103rilor s\u0103 stabileasc\u0103 nu doar faptul execut\u0103rii unui anumit fi\u0219ier, ci, \u00een unele cazuri, s\u0103 reconstituie tactici \u0219i tehnici specifice ale atacatorilor. Ast\u0103zi, infractorii cibernetici folosesc adesea instrumente pentru \u0219tergerea irevocabil\u0103 a datelor, cum ar fi SDelete, a\u0219a c\u0103 abilitatea de a recupera m\u0103car urme de utilizare a anumitor tactici \u0219i tehnici este absolut necesar\u0103 pentru orice specialist modern \u00een securitate - expert \u00een criminalistica informatic\u0103, specialist \u00een r\u0103spunsul la incidente, expert ThreatHunter.<\/p>\n

S\u0103 \u00eencepem cu tactica Acces Ini\u021bial (TA0001) \u0219i cea mai popular\u0103 tehnic\u0103 - Spearphishing Attachment (T1193). Unele grupuri de criminalitate cibernetic\u0103 abordeaz\u0103 alegerea acestor ata\u0219amente \u00eentr-un mod destul de creativ. De exemplu, grupul Silence a folosit fi\u0219iere \u00een format CHM (Microsoft Compiled HTML Help) pentru acest scop. Astfel, avem \u00eenc\u0103 o tehnic\u0103 - Fi\u0219ier HTML Compilat (T1223). Aceste fi\u0219iere sunt lansate prin hh.exe<\/b>, prin urmare, dac\u0103 extragem datele din fi\u0219ierul s\u0103u Prefetch, vom afla exact ce fi\u0219ier a fost deschis de victim\u0103:<\/p>\n

\"V\u00e2n\u0103toare
\nS\u0103 continu\u0103m cu exemple din cazuri reale \u0219i s\u0103 trecem la urm\u0103toarea tactic\u0103 Executare (TA0002) \u0219i tehnica CSMTP (T1191). Microsoft Connection Manager Profile Installer (CMSTP.exe) poate fi folosit de atacatori pentru a rula scripturi r\u0103u-voitoare. Un bun exemplu este grupul Cobalt. Dac\u0103 extragem datele din fi\u0219ierul Prefetch cmstp.exe<\/b>, vom putea din nou s\u0103 afl\u0103m ce a fost lansat:<\/p>\n

\"V\u00e2n\u0103toare
\nO alt\u0103 tehnic\u0103 popular\u0103 este Regsvr32 (T1117). Regsvr32.exe<\/b> este de asemenea folosit frecvent de atacatori pentru a rula. Uite un alt exemplu de la grupul Cobalt: dac\u0103 extragem datele din fi\u0219ierul Prefetch regsvr32.exe<\/b>, vom observa din nou ce a fost lansat:<\/p>\n

\"V\u00e2n\u0103toare
\nUrm\u0103toarele tactici sunt Persisten\u021b\u0103 (TA0003) \u0219i Cre\u0219terea Privilegiilor (TA0004), precum \u0219i Application Shimming (T1138) ca tehnic\u0103. Aceast\u0103 tehnic\u0103 a fost utilizat\u0103 de Carbanak\/FIN7 pentru a se stabili \u00een sistem. De obicei, pentru a lucra cu baze de date con\u021bin\u00e2nd informa\u021bii despre compatibilitatea programelor (.sdb), se folose\u0219te sdbinst.exe<\/b>. Prin urmare, fi\u0219ierul Prefetch al acestui fi\u0219ier executabil ne poate ajuta s\u0103 afl\u0103m numele acestor baze de date \u0219i loca\u021bia lor:<\/p>\n

\"V\u00e2n\u0103toare
\nA\u0219a cum se vede \u00een ilustra\u021bie, avem nu doar numele fi\u0219ierului folosit pentru instalare, ci \u0219i numele bazei de date instalate.<\/p>\n

S\u0103 arunc\u0103m o privire asupra unuia dintre cele mai tipice exemple de promovare online (TA0008) \u2014 PsExec, care utilizeaz\u0103 resurse partajate administrative (T1077). Serviciul cu numele PSEXECSVC (desigur, poate fi folosit orice alt nume, dac\u0103 atacatorii au folosit parametrul -r<\/b>) va fi creat pe sistemul \u021bint\u0103, a\u0219adar, dac\u0103 extragem date din fi\u0219ierul Prefetch, vom vedea ce a fost pornit:<\/p>\n

\"V\u00e2n\u0103toare
\nVoi \u00eencheia, probabil, cu ceea ce am \u00eenceput \u2014 \u0219tergerea fi\u0219ierelor (T1107). A\u0219a cum am men\u021bionat, mul\u021bi atacatori folosesc SDelete pentru a \u0219terge definitiv fi\u0219ierele \u00een diverse etape ale ciclului de via\u021b\u0103 al atacului. Dac\u0103 arunc\u0103m o privire la datele din fi\u0219ierul Prefetch sdelete.exe<\/b>, vom vedea exact ce a fost \u0219ters:<\/p>\n

\"V\u00e2n\u0103toare<\/p>\n

Desigur, acesta nu este un list\u0103 exhaustiv\u0103 de tehnici care pot fi descoperite \u00een timpul analizei fi\u0219ierelor Prefetch, dar ar trebui s\u0103 fie suficient pentru a \u00een\u021belege c\u0103 astfel de fi\u0219iere pot ajuta nu doar la g\u0103sirea urmelor de pornire, ci \u0219i la reconstructia tacticilor \u0219i tehnicilor atacatorilor.
\n
Sursa: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0424\u0430\u0439\u043b\u044b \u0442\u0440\u0430\u0441\u0441\u0438\u0440\u043e\u0432\u043a\u0438, \u0438\u043b\u0438 Prefetch-\u0444\u0430\u0439\u043b\u044b, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 Windows \u0435\u0449\u0435 \u0441\u043e \u0432\u0440\u0435\u043c\u0435\u043d XP. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u043e\u043d\u0438 \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u043f\u043e \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u044b\u0435 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u044b \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445. \u0412\u0435\u0434\u0443\u0449\u0438\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u043e\u0439 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u043a\u0435 Group-IB \u041e\u043b\u0435\u0433 \u0421\u043a\u0443\u043b\u043a\u0438\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 \u0438 \u043a\u0430\u043a \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c. Prefetch-\u0444\u0430\u0439\u043b\u044b \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41615,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41614","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u00e2n\u0103m tehnicile \u0219i tacticile atacatorilor folosind fi\u0219ierele Prefetch | ProHoster","description":"Fi\u0219iere.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0445\u043e\u0442\u0438\u043c\u0441\u044f \u043d\u0430 \u0442\u0435\u0445\u043d\u0438\u043a\u0438 \u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0445 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Prefetch-\u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster","og:description":"\u0424\u0430\u0439\u043b\u044b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/ohotimsya-na-tehniki-i-taktiki-atakuyushhih-s-ispolzovaniem-prefetch-fajlov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-13T17:48:26+00:00","article:modified_time":"2020-02-13T17:48:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41614","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:13:40","updated":"2022-09-28 14:43:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=41614"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41614\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/41615"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=41614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=41614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=41614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}