The following is based on true events from 2014, which occurred in a small start-up company in Monroe, CT.
A new small to medium-sized eCommerce start-up based in Monroe, CT has recently begun to notice anomalies in their financial records. They have also recently received a number of customer complaints saying that invoices received from the company often bill more services than the customers asked for, and they are often directed to send check payments to a PO Box that does not look legitimate.
Upon reviewing their most recent set of invoices (saved as plain text files), the accounting department notices that the information in the invoices is incorrect, as reported by the customer complaints. The CEO orders an immediate investigation of the three accountants’ computers, which had only recently been purchased last month from a bankrupt Bitcoin mining company.
As a growing company, they only employ a small team of six part-time IT support professionals. They undertake an initial check of the systems, and they find a suspicious process running on one of the computers which seems to be connected to a McAfee service with a large amount of data being sent outside the company firewall. At this point, they do not feel that they have the expertise to carry out a full-scale malware/forensic investigation, and becoming nervous of a possible attack, the IT team scribbles down the name of the suspicious process (“greencat-2”) and quickly shuts down all three accounting department computers and unplugs their power cords.
As there is increased competition in the start-up eCommerce domain, the company is anxious to ensure that their systems have not been compromised. The CEO quickly employs a cyber forensic investigator (YOU) to determine what malicious activity has taken place, where it originated from, and if the company is to blame (i.e., could be sued) for any damages.
Unfortunately, because the accounting department computers contain sensitive customer financial information, the CEO will only allow you access to the suspicious greencat-2 binary. By investigating only this binary, can you determine:
- Could greencat-2 or disgruntled accounting employees be responsible for manipulating the company’s financial records and customer invoices?
- Was greencat-2 targeting the startup eCommerce company all along, or could it have come from somewhere else?
- What could explain the “large amount of data being sent outside the company firewall” that the company’s IT observed? What functionality in greencat-2 could cause a large amount of data to be sent out over the network?
Instructions:
Download webc2-greencat-2.7z from Canvas.
Move this zip file to where you’re running GHIDRA and unzip it using the following 7z command. The 7z file is password-protected. The password is “infected” (no quotes).
7z e webc2-greencat-2.7z
After you unzip the malware, check that the unzipped malware binary file’s MD5 hash is correct. GHIDRA will also show the MD5 hash after loading the binary, so double-check in GHIDRA as well.
57e79f7df13c0cb01910d0c688fcd296 webc2-greencat-2
Load the executable into GHIDRA— this malware is a standard 32-bit PE executable.
Starting from the WinMain(…) function located at 0x0040297D, follow the control flow in the disassembly. Imagine that you are a recursive-descent disassembler — starting from the entry of each function and going until the return of that function.
Comments should be placed on every block of logically-related instructions. “Logically-related” is defined as a minimum of 1 comment at the end of each basic block. Control-flow modifying instructions (calls, jumps, etc.) must be commented in addition to the minimum “logically-related” requirement.
Since this binary is dynamically linked, you will have to Google any library functions that you do not know. This will be important for understanding the return values and side effects (e.g., the memory copied by strcpy) of the library functions.
It will be helpful if you keep track of the values in memory! For example: some library calls will save data into a buffer in memory (e.g., GetUserNameExA) and then greencat-2 will use that data later on. GHIDRA can help with this — it shows empty space where static variables should be. You can double-click any static variable’s name to jump to its location and add comments or dummy values. Unfortunately, GHIDRA cannot help with dynamically allocated variables. You do not have to turn in anything related to memory tracking, but it will be helpful to you.
Optional: Provide answers to the 3 investigation questions from above in a file called answers.txt and submit it with your lab submission in Gradescope. MAX of 5 sentences per answer. 5 bonus points per correct answer.
As always: Post any questions or ideas on Ed Discussion! Even code snippets are fine, as long as they do not give away a key answer to this assignment. Class collaboration is encouraged — It’s us versus malware! If you’re not sure if your post is safe, send it to the Prof/TA in a private post to verify.
Grade:
100 Points
Grading Criteria:
The grade will be based on how well you understood the functionality and capabilities of greencat-2.
-10 points for each key malware functionality that your team fails to comment or entirely misunderstands (e.g., your comments say the code is reading a file, but it is really writing to a socket). All key malware functionality in greencat-2 are reachable via careful recursive-descent (there are no anti-disassembly tricks). We will not deduct points for misunderstanding single instructions.
-5 points for not following the instructions for Exporting Comments from GHIDRA.
Bonus:
5 bonus points will be awarded for each correct answer to the 3 investigation questions above.
Teams:
This assignment can be done individually or in a team of 2. Please join a group in Gradescope if you are collaborating.
Do not create or join a group in Canvas. Canvas groups are different from Gradescope groups.
New to Gradescope? This link provides instructions for how to create groups in Gradescope: https://help.gradescope.com/article/m5qz2xsnjy-student-add-group-members
Zoom can also provide the ability to collaborate and video conference with your teammate.
If you would like to set it up, your team can collaborate using a GHIDRA server. The instructions for that can be found at the following blog post. Make sure to configure your server in a way that is not publicly available. This is outside the scope of this class, so we cannot provide IT support for GHIDRA servers, but please post any questions or tips on Ed!
https://byte.how/posts/collaborative-reverse-engineering/
For people new to GHIDRA and would like to get some insight, here is a blog post for that as well. https://byte.how/posts/what-are-you-telling-me-ghidra/
Submission Instructions:
Upload your commented ASCII Listing file exported from GHIDRA (called submission.txt) to the assignment in Gradescope.
Note: Gradescope will only check the formatting of your submission. Gradescope will not automatically check for correctness and provide a grade.
Upload your answers to the three questions in a file named answers.txt. Do not zip or compress the files.
Note: You can download the webc2-greencat-2.7z file directly into your lab environment. After you are done with this lab, you can submit your files directly from the lab environment (Highly recommended). Doing this will help you avoid transferring the file from the lab workspace to your personal computer.
Exporting Comments from GHIDRA:
-5 points for not following these steps properly.
Default export settings in GHIDRA will truncate comments!
Click on File and then click on Export program as shown in figure below.
This will open a new pop-up in that choose ASCII format as shown in figure below.
Click on options to increase the end of line width (max comment width).
Transferring Files:
To transfer files from your personal device to the lab environment:
Create a zip folder of all the files that you would like to transfer to the lab environment.
Every GT student has Box and OneDrive accounts freely provided by the institute. You may use either of those services to upload the desired files from your personal device and download them to the lab environment.
In this class, you will never be given malware samples that target or infect Box, OneDrive, or Canvas. As such, you are safe to use those services.
Frequently Asked Questions (FAQ)
How To Run Symbol Analysis In GHIDRA?
A helpful analysis technique for malware is loading known library symbols into Ghidra. Ghidra is capable of automatically naming known functions if it knows where to look! Check out this video for more information: https://www.youtube.com/watch?v=u15-r5Erfnw&ab_channel=0x6d696368
How To Add New Header Files To GHIDRA?
The following video shows how you create header files and then load them into Ghidra to use for setting datatypes to whatever you defined. https://www.youtube.com/watch?v=u15-r5Erfnw&ab_channel=0x6d696368
Is ChatGPT (or other AI assistance) Allowed?
The short answer is yes, ChatGPT or other AI assistance software is allowed for this assignment. After all, real practitioners will use all of the tools at their disposal to fight malware. Please keep in mind the following, however:
Do not directly copy anything from the AI assistant chat window. It is crucial for you to be able to articulate your understanding in your own words.
ChatGPT and all other AI assistants are notoriously bad at interpreting assembly, especially assembly that a malware author is intentionally trying to obfuscate for a human analyst! Do not blindly assume that the AI assistant’s interpretation is correct.
Often, an AI assistant’s interpretation of assembly does not capture the true intention of the code, and instead regurgitates the actions of the CPU for each instruction. We are expecting your comments to encapsulate the high-level reason for the code’s existence, and it is not sufficient to explain which registers are storing which values without understanding the underlying reasoning.
Technical Difficulties With Azure Labs?
If you are experiencing technical difficulties, please review the Azure Labs Info page in Canvas. That page provides multiple recommendations for solving technical difficulties.
If the problem persists and you have tried everything mentioned in Canvas, let the Professor and TAs know via Ed Discussion using a private post.
