evolution-of-poweliks

Recommendations

Info

The evolution of the fileless click-fraud malware Poweliks Figure 6. Script 2 encoded using COM programing Script 2 is then run through an encoder using COM programming. The new value from the COM-encoded Script 2 will be added to the registry as the following registry entry: • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”a” = “#@~^ZXgAAA==W!x^DkK...” This is then used as part of Poweliks’ fileless autostart mechanism. At this point, Poweliks will use an alternate data stream to delete the original file and load the Watchdog DLL into memory. From this point on, Poweliks is truly fileless. Figure 7 illustrates how Poweliks operates from inside the registry. Poweliks also found a way to creatively protect itself in memory. In certain variants of Poweliks where a different registry entry is used as an automatic load point, Poweliks creates an extra registry subkey, seen in the Figure 8. Figure 7. Poweliks maintains its registry entries to ensure persistence Page 8
The evolution of the fileless click-fraud malware Poweliks Figure 8. Extra registry subkey to protect Poweliks in memory The protection mechanism used here prevents the subkey from being opened. This in turn prevents the subkey from being deleted. This is achieved when Poweliks creates a registry subkey in Unicode with an ObjectName of 0608 that prevents users, even those with administrator privileges, from reading or deleting it. With tricks like these, it is obvious that the creators of Poweliks have an intimate knowledge of the Windows registry. Figure 9. Registry subkey created in Unicode to protect Poweliks Watchdog The Watchdog DLL launched from the registry entry is loaded every time Windows starts. The Watchdog process starts Windows’ dllhost.exe and injects itself into it. With the process loaded in memory, another thread is used to make sure that the relevant registry load points are continuously primed to load Poweliks. This module is Page 9
Page 1 and 2: SECURITY RESPONSE The evolution of
Page 3 and 4: OVERVIEW Trojan.Poweliks is a filel
Page 5 and 6: The evolution of the fileless click
Page 7: The evolution of the fileless click
Page 27 and 28: APPENDIX
Page 35: Authors Liam O’Murchu Sr Mgr, Dev

evolution-of-poweliks

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?