SlideShare a Scribd company logo
1 of 1
Download to read offline
A piece of malware is running on a Windows 7 machine via process injection, so it does not
show up in a process list. What remote forensic technique could be used to discover the malware
is running under the contents of a specific process?
Solution
Remote Forensic Technique:
Since the malwares are designed in such a way that are not listed in the
process list on windows machine. So it is difficult to work against the malware since it is invisble
from process list.
However we can use "Process Monitoring tool from Sysinternals" technique to catch and
eliminate the malware/thread activities. It makes use of two legacy sysinternal utilities like
"Filemon" and "Regmon". also it includes rich and non destructive filtering,session ID's
reliable process informations,parallel login to file and more.It achives the process monitoring to
become the more powerful troubleshooting and malware hunting toolkit.
Features of Process Monitoring:
a. Data capture of input and output parameters for operation.
b. Setting non destructive filter to filter without losing the data.
c. Identifying the thread stacks for each operation, which allows to find root cause of the
operation in many case.
d. Native log format preserves all data for loading in different process monitor instances.

More Related Content

Similar to A piece of malware is running on a Windows 7 machine via process inj.pdf

Create a software key logger
Create a software key logger Create a software key logger
Create a software key logger
GiralFaurel
 
Malware analysis and detection using reverse Engineering, Available at: www....
Malware analysis and detection using reverse Engineering,  Available at: www....Malware analysis and detection using reverse Engineering,  Available at: www....
Malware analysis and detection using reverse Engineering, Available at: www....
Research Publish Journals (Publisher)
 
Sa No Scan Paper
Sa No Scan PaperSa No Scan Paper
Sa No Scan Paper
tafinley
 
Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039
Editor IJARCET
 
Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039
Editor IJARCET
 

Similar to A piece of malware is running on a Windows 7 machine via process inj.pdf (20)

Create a software key logger
Create a software key logger Create a software key logger
Create a software key logger
 
FBI & Secret Service- Business Email Compromise Workshop
FBI & Secret Service- Business Email Compromise WorkshopFBI & Secret Service- Business Email Compromise Workshop
FBI & Secret Service- Business Email Compromise Workshop
 
ransomware keylogger rootkit.pptx
ransomware keylogger rootkit.pptxransomware keylogger rootkit.pptx
ransomware keylogger rootkit.pptx
 
43 automatic
43 automatic43 automatic
43 automatic
 
Enchaning system effiency through process scanning
Enchaning system effiency through process scanningEnchaning system effiency through process scanning
Enchaning system effiency through process scanning
 
Identifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting MalwareIdentifying, Monitoring, and Reporting Malware
Identifying, Monitoring, and Reporting Malware
 
Malware analysis and detection using reverse Engineering, Available at: www....
Malware analysis and detection using reverse Engineering,  Available at: www....Malware analysis and detection using reverse Engineering,  Available at: www....
Malware analysis and detection using reverse Engineering, Available at: www....
 
Advanced malware analysis training session1 detection and removal of malwares
Advanced malware analysis training session1 detection and removal of malwaresAdvanced malware analysis training session1 detection and removal of malwares
Advanced malware analysis training session1 detection and removal of malwares
 
Advanced Malware Analysis Training - Detection and Removal of Malwares
Advanced Malware Analysis Training - Detection and Removal of MalwaresAdvanced Malware Analysis Training - Detection and Removal of Malwares
Advanced Malware Analysis Training - Detection and Removal of Malwares
 
Sa No Scan Paper
Sa No Scan PaperSa No Scan Paper
Sa No Scan Paper
 
Final project.ppt
Final project.pptFinal project.ppt
Final project.ppt
 
Reversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysisReversing malware analysis trainingpart9 advanced malware analysis
Reversing malware analysis trainingpart9 advanced malware analysis
 
Advanced Threats in the Enterprise: Finding an Evil in the Haystack
Advanced Threats in the Enterprise: Finding an Evil in the HaystackAdvanced Threats in the Enterprise: Finding an Evil in the Haystack
Advanced Threats in the Enterprise: Finding an Evil in the Haystack
 
Chapter 1 malware analysis primer
Chapter 1 malware analysis primerChapter 1 malware analysis primer
Chapter 1 malware analysis primer
 
Key logger,Why? and How to prevent Them?
Key logger,Why? and  How to prevent Them?Key logger,Why? and  How to prevent Them?
Key logger,Why? and How to prevent Them?
 
Cyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on ExamplesCyber Defense Forensic Analyst - Real World Hands-on Examples
Cyber Defense Forensic Analyst - Real World Hands-on Examples
 
Types of malicious software and remedies
Types of malicious software and remediesTypes of malicious software and remedies
Types of malicious software and remedies
 
Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039
 
Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039Volume 2-issue-6-2037-2039
Volume 2-issue-6-2037-2039
 
Cyber warfare introduction
Cyber warfare introductionCyber warfare introduction
Cyber warfare introduction
 

More from fms12345

Exercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdf
Exercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdfExercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdf
Exercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdf
fms12345
 
CHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdf
CHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdfCHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdf
CHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdf
fms12345
 
Company names Aerial Drones Surveillance Inc. Your company descript.pdf
Company names Aerial Drones Surveillance Inc. Your company descript.pdfCompany names Aerial Drones Surveillance Inc. Your company descript.pdf
Company names Aerial Drones Surveillance Inc. Your company descript.pdf
fms12345
 
13 808 PM docs.google.com Covalent Bonding and lonic Bonding study.pdf
13 808 PM  docs.google.com Covalent Bonding and lonic Bonding study.pdf13 808 PM  docs.google.com Covalent Bonding and lonic Bonding study.pdf
13 808 PM docs.google.com Covalent Bonding and lonic Bonding study.pdf
fms12345
 
What specialized cells line the inner cavity and move fluids through.pdf
What specialized cells line the inner cavity and move fluids through.pdfWhat specialized cells line the inner cavity and move fluids through.pdf
What specialized cells line the inner cavity and move fluids through.pdf
fms12345
 
What are the major developmental milestones between infancy and todd.pdf
What are the major developmental milestones between infancy and todd.pdfWhat are the major developmental milestones between infancy and todd.pdf
What are the major developmental milestones between infancy and todd.pdf
fms12345
 
TV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdf
TV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdfTV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdf
TV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdf
fms12345
 
Tim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdf
Tim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdfTim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdf
Tim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdf
fms12345
 

More from fms12345 (20)

Exercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdf
Exercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdfExercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdf
Exercise 1 (10 Points) Define a FixdLenStringList class that encaps.pdf
 
Describe the procedure you would use in the laboratory to determine .pdf
Describe the procedure you would use in the laboratory to determine .pdfDescribe the procedure you would use in the laboratory to determine .pdf
Describe the procedure you would use in the laboratory to determine .pdf
 
CHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdf
CHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdfCHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdf
CHEM 1011 Discussion question 2ObjectiveTo learn more about the .pdf
 
Could you implement this please. I was told to use pointers as the d.pdf
Could you implement this please. I was told to use pointers as the d.pdfCould you implement this please. I was told to use pointers as the d.pdf
Could you implement this please. I was told to use pointers as the d.pdf
 
Company names Aerial Drones Surveillance Inc. Your company descript.pdf
Company names Aerial Drones Surveillance Inc. Your company descript.pdfCompany names Aerial Drones Surveillance Inc. Your company descript.pdf
Company names Aerial Drones Surveillance Inc. Your company descript.pdf
 
2. The Lorenz curve measures inequality in person income distribution.pdf
2. The Lorenz curve measures inequality in person income distribution.pdf2. The Lorenz curve measures inequality in person income distribution.pdf
2. The Lorenz curve measures inequality in person income distribution.pdf
 
13 808 PM docs.google.com Covalent Bonding and lonic Bonding study.pdf
13 808 PM  docs.google.com Covalent Bonding and lonic Bonding study.pdf13 808 PM  docs.google.com Covalent Bonding and lonic Bonding study.pdf
13 808 PM docs.google.com Covalent Bonding and lonic Bonding study.pdf
 
1.The shrimping industry needs female shrimp for production purposes.pdf
1.The shrimping industry needs female shrimp for production purposes.pdf1.The shrimping industry needs female shrimp for production purposes.pdf
1.The shrimping industry needs female shrimp for production purposes.pdf
 
Who are the stakeholders in an income statement and whySolution.pdf
Who are the stakeholders in an income statement and whySolution.pdfWho are the stakeholders in an income statement and whySolution.pdf
Who are the stakeholders in an income statement and whySolution.pdf
 
Which company maintains natural habitats while B allowing us to live .pdf
Which company maintains natural habitats while B allowing us to live .pdfWhich company maintains natural habitats while B allowing us to live .pdf
Which company maintains natural habitats while B allowing us to live .pdf
 
When multiple strains of the same bacterial species are sequenced, w.pdf
When multiple strains of the same bacterial species are sequenced, w.pdfWhen multiple strains of the same bacterial species are sequenced, w.pdf
When multiple strains of the same bacterial species are sequenced, w.pdf
 
What specialized cells line the inner cavity and move fluids through.pdf
What specialized cells line the inner cavity and move fluids through.pdfWhat specialized cells line the inner cavity and move fluids through.pdf
What specialized cells line the inner cavity and move fluids through.pdf
 
What does the metaphor meaning for the Iron curtainSolutionIr.pdf
What does the metaphor meaning for the Iron curtainSolutionIr.pdfWhat does the metaphor meaning for the Iron curtainSolutionIr.pdf
What does the metaphor meaning for the Iron curtainSolutionIr.pdf
 
What are the major developmental milestones between infancy and todd.pdf
What are the major developmental milestones between infancy and todd.pdfWhat are the major developmental milestones between infancy and todd.pdf
What are the major developmental milestones between infancy and todd.pdf
 
Using the Web or another research tool, search for alternative means.pdf
Using the Web or another research tool, search for alternative means.pdfUsing the Web or another research tool, search for alternative means.pdf
Using the Web or another research tool, search for alternative means.pdf
 
Using Array Approach, Linked List approach, and Delete Byte Approach.pdf
Using Array Approach, Linked List approach, and Delete Byte Approach.pdfUsing Array Approach, Linked List approach, and Delete Byte Approach.pdf
Using Array Approach, Linked List approach, and Delete Byte Approach.pdf
 
TV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdf
TV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdfTV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdf
TV Guide magazine ran a cover photo for a story emphasizing Oprah Wi.pdf
 
Tim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdf
Tim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdfTim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdf
Tim Tassopoulos, the chief operating officer for Chick-Fll-A applies .pdf
 
The Hydrolysis of the Hydrated Pb ion PboH (aq) + H200SolutionP.pdf
The Hydrolysis of the Hydrated Pb ion PboH (aq) + H200SolutionP.pdfThe Hydrolysis of the Hydrated Pb ion PboH (aq) + H200SolutionP.pdf
The Hydrolysis of the Hydrated Pb ion PboH (aq) + H200SolutionP.pdf
 
1. CDOs are normally divided into tranches. Holders of this tranche .pdf
1. CDOs are normally divided into tranches. Holders of this tranche .pdf1. CDOs are normally divided into tranches. Holders of this tranche .pdf
1. CDOs are normally divided into tranches. Holders of this tranche .pdf
 

Recently uploaded

Spellings Wk 4 and Wk 5 for Grade 4 at CAPS
Spellings Wk 4 and Wk 5 for Grade 4 at CAPSSpellings Wk 4 and Wk 5 for Grade 4 at CAPS
Spellings Wk 4 and Wk 5 for Grade 4 at CAPS
AnaAcapella
 

Recently uploaded (20)

Unit 3 Emotional Intelligence and Spiritual Intelligence.pdf
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdfUnit 3 Emotional Intelligence and Spiritual Intelligence.pdf
Unit 3 Emotional Intelligence and Spiritual Intelligence.pdf
 
Jamworks pilot and AI at Jisc (20/03/2024)
Jamworks pilot and AI at Jisc (20/03/2024)Jamworks pilot and AI at Jisc (20/03/2024)
Jamworks pilot and AI at Jisc (20/03/2024)
 
FICTIONAL SALESMAN/SALESMAN SNSW 2024.pdf
FICTIONAL SALESMAN/SALESMAN SNSW 2024.pdfFICTIONAL SALESMAN/SALESMAN SNSW 2024.pdf
FICTIONAL SALESMAN/SALESMAN SNSW 2024.pdf
 
This PowerPoint helps students to consider the concept of infinity.
This PowerPoint helps students to consider the concept of infinity.This PowerPoint helps students to consider the concept of infinity.
This PowerPoint helps students to consider the concept of infinity.
 
Sensory_Experience_and_Emotional_Resonance_in_Gabriel_Okaras_The_Piano_and_Th...
Sensory_Experience_and_Emotional_Resonance_in_Gabriel_Okaras_The_Piano_and_Th...Sensory_Experience_and_Emotional_Resonance_in_Gabriel_Okaras_The_Piano_and_Th...
Sensory_Experience_and_Emotional_Resonance_in_Gabriel_Okaras_The_Piano_and_Th...
 
dusjagr & nano talk on open tools for agriculture research and learning
dusjagr & nano talk on open tools for agriculture research and learningdusjagr & nano talk on open tools for agriculture research and learning
dusjagr & nano talk on open tools for agriculture research and learning
 
Single or Multiple melodic lines structure
Single or Multiple melodic lines structureSingle or Multiple melodic lines structure
Single or Multiple melodic lines structure
 
NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...
NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...
NO1 Top Black Magic Specialist In Lahore Black magic In Pakistan Kala Ilam Ex...
 
Graduate Outcomes Presentation Slides - English
Graduate Outcomes Presentation Slides - EnglishGraduate Outcomes Presentation Slides - English
Graduate Outcomes Presentation Slides - English
 
Basic Civil Engineering first year Notes- Chapter 4 Building.pptx
Basic Civil Engineering first year Notes- Chapter 4 Building.pptxBasic Civil Engineering first year Notes- Chapter 4 Building.pptx
Basic Civil Engineering first year Notes- Chapter 4 Building.pptx
 
OSCM Unit 2_Operations Processes & Systems
OSCM Unit 2_Operations Processes & SystemsOSCM Unit 2_Operations Processes & Systems
OSCM Unit 2_Operations Processes & Systems
 
Python Notes for mca i year students osmania university.docx
Python Notes for mca i year students osmania university.docxPython Notes for mca i year students osmania university.docx
Python Notes for mca i year students osmania university.docx
 
Towards a code of practice for AI in AT.pptx
Towards a code of practice for AI in AT.pptxTowards a code of practice for AI in AT.pptx
Towards a code of practice for AI in AT.pptx
 
How to Manage Global Discount in Odoo 17 POS
How to Manage Global Discount in Odoo 17 POSHow to Manage Global Discount in Odoo 17 POS
How to Manage Global Discount in Odoo 17 POS
 
How to Manage Call for Tendor in Odoo 17
How to Manage Call for Tendor in Odoo 17How to Manage Call for Tendor in Odoo 17
How to Manage Call for Tendor in Odoo 17
 
REMIFENTANIL: An Ultra short acting opioid.pptx
REMIFENTANIL: An Ultra short acting opioid.pptxREMIFENTANIL: An Ultra short acting opioid.pptx
REMIFENTANIL: An Ultra short acting opioid.pptx
 
Google Gemini An AI Revolution in Education.pptx
Google Gemini An AI Revolution in Education.pptxGoogle Gemini An AI Revolution in Education.pptx
Google Gemini An AI Revolution in Education.pptx
 
Spellings Wk 4 and Wk 5 for Grade 4 at CAPS
Spellings Wk 4 and Wk 5 for Grade 4 at CAPSSpellings Wk 4 and Wk 5 for Grade 4 at CAPS
Spellings Wk 4 and Wk 5 for Grade 4 at CAPS
 
Food safety_Challenges food safety laboratories_.pdf
Food safety_Challenges food safety laboratories_.pdfFood safety_Challenges food safety laboratories_.pdf
Food safety_Challenges food safety laboratories_.pdf
 
On National Teacher Day, meet the 2024-25 Kenan Fellows
On National Teacher Day, meet the 2024-25 Kenan FellowsOn National Teacher Day, meet the 2024-25 Kenan Fellows
On National Teacher Day, meet the 2024-25 Kenan Fellows
 

A piece of malware is running on a Windows 7 machine via process inj.pdf

  • 1. A piece of malware is running on a Windows 7 machine via process injection, so it does not show up in a process list. What remote forensic technique could be used to discover the malware is running under the contents of a specific process? Solution Remote Forensic Technique: Since the malwares are designed in such a way that are not listed in the process list on windows machine. So it is difficult to work against the malware since it is invisble from process list. However we can use "Process Monitoring tool from Sysinternals" technique to catch and eliminate the malware/thread activities. It makes use of two legacy sysinternal utilities like "Filemon" and "Regmon". also it includes rich and non destructive filtering,session ID's reliable process informations,parallel login to file and more.It achives the process monitoring to become the more powerful troubleshooting and malware hunting toolkit. Features of Process Monitoring: a. Data capture of input and output parameters for operation. b. Setting non destructive filter to filter without losing the data. c. Identifying the thread stacks for each operation, which allows to find root cause of the operation in many case. d. Native log format preserves all data for loading in different process monitor instances.