PaperlayerView exact revision on arXiv

Source-linked AI summary

Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware

Qian Chen, Robert A. Bridges

arXiv:1709.08753v1cs.CR

TL;DR

Ransomware defense and sandbox analysis require laborious interpretation of high-volume logs, motivating automated malware-footprint extraction. The paper applies TF-IDF to ambient and malware-containing logs, finding discriminative, human-understandable features that remain robust to polymorphic WannaCry samples and varied ambient data.

  • Problem

    No automated method was known for extracting malware footprints from ambient or sandbox-generated logs, despite the need to reduce extensive manual analysis.

  • Method

    The method applies TF-IDF to ambient logs and logs containing malware activity to extract and rank discriminating, human-understandable features.

  • Results

    The experiments validate accurate extraction of distinguishing ransomware features from predominantly non-malicious logs and robustness to polymorphic WannaCry and varied inputs.

  • Takeaways & Limitations

    Automatically generated behavioral patterns can support malware analysis from host or sandbox logs, including when ransomware activity is mixed with ambient events.

Abstract

from arXiv · show

Ransomware, a class of self-propagating malware that uses encryption to hold the victims' data ransom, has emerged in recent years as one of the most dangerous cyber threats, with widespread damage; e.g., zero-day ransomware WannaCry has caused world-wide catastrophe, from knocking U.K. National Health Service hospitals offline to shutting down a Honda Motor Company in Japan[1]. Our close collaboration with security operations of large enterprises reveals that defense against ransomware relies on tedious analysis from high-volume systems logs of the first few infections. Sandbox analysis of freshly captured malware is also commonplace in operation. We introduce a method to identify and rank the most discriminating ransomware features from a set of ambient (non-attack) system logs and at least one log stream containing both ambient and ransomware behavior. These ranked features reveal a set of malware actions that are produced automatically from system logs, and can help automate tedious manual analysis. We test our approach using WannaCry and two polymorphic samples by producing logs with Cuckoo Sandbox during both ambient, and ambient plus ransomware executions. Our goal is to extract the features of the malware from the logs with only knowledge that malware was present. We compare outputs with a detailed analysis of WannaCry allowing validation of the algorithm's feature extraction and provide analysis of the method's robustness to variations of input data\textemdash changing quality/quantity of ambient data and testing polymorphic ransomware. Most notably, our patterns are accurate and unwavering when generated from polymorphic WannaCry copies, on which 63 (of 63 tested) anti-virus (AV) products fail.

I. INTRODUCTION

The paper addresses the need to automate malware-footprint extraction from large volumes of ambient and infected logs, using ranked, human-understandable features to support ransomware analysis.

  • Motivation: The work targets labor-intensive manual analysis of high-volume logs from a few infected hosts, including potentially polymorphic malware.The operational motivation includes forensic analysis and sandbox-based analysis of newly discovered samples.
  • Contribution: The proposed algorithm extracts features that discriminate malware from ambient activity using logs known to contain malware and logs known to contain no malware.The method is designed for collections containing ambient activity alongside malware executions.
  • Method: TF-IDF automatically extracts and ranks discriminating features while preserving human-understandable behavioral indicators.Human interpretability is presented as necessary for operators using automated malware analysis.
  • Experimental basis: Cuckoo Sandbox supplies repeatable dynamic-analysis logs covering files, folders, memory, network traffic, processes, and API calls for WannaCry and normal-activity executions.The experiments use WannaCry variants and scripts simulating non-malicious user activity.
  • Evaluation: The experiments test automatic feature extraction and robustness to changes in the quantity of known non-malicious logging data.The algorithm’s outputs are validated against detailed WannaCry analysis.

A. Related Work

Prior work includes dynamic sandbox systems for ransomware detection and repeatable malware-analysis data generation; this paper instead extracts discriminative malware features from logs generically.

  • Dynamic analysis: Static analysis can struggle with self-modifying and polymorphic code, whereas dynamic analysis observes malware behavior by executing samples.The paper uses Cuckoo Sandbox for dynamic analysis.
  • Cuckoo Sandbox: Cuckoo Sandbox has supported polymorphic-malware identification, sandbox-evasion studies, network-indicator generation, and supervised IDS data generation.These uses establish Cuckoo as a repeatable malware-analysis tool.
  • Existing ransomware detection: UNVEIL detects ransomware and models behavior by comparing desktop screenshots before, during, and after malware execution.It identified previously unknown evasive ransomware missed by antimalware software.
  • Distinction: Unlike UNVEIL’s ransomware-detection focus, this work generically extracts discriminative features from logging data and identifies WannaCry indicators before file encryption.The approach was specifically tested with WannaCry.

A. WannaCry Ransomware Attack

WannaCry uses a dropper to propagate through SMB and an encryption component to encrypt victim files. Cuckoo Sandbox records its actions across system activity categories and produces human-readable reports for analysis.

  • WannaCry’s dropper uses the EternalBlue exploit against Windows’ SMB vulnerability to propagate, while a second component performs ransomware encryption.
  • Cuckoo Sandbox executes suspicious files in an isolated virtual environment while monitoring files, folders, memory, network traffic, processes, and API calls.Its reporting module saves results in human-readable JSON and HTML formats.
  • The attack scans the file system, identifies target files, and generates one AES key per file before encryption.
  • WannaCry encrypts each file’s AES key with a public RSA key and saves the encrypted key in the target file.
  • The malware encrypts files with CreateFileW, ReadFile, and WriteFile APIs, writing the string WANNACRY to infected files.
  • The reported action sequence includes replacing temporary encrypted files, launching a decryption tool, changing the desktop image, and creating a registry run key.

III. METHOD: FEATURES & TF-IDF

The method treats log streams as documents and selected log entries as features, then uses TF-IDF to rank features that are frequent in infected logs but uncommon in ambient logs. Ransomware analysis focuses on pre-encryption activity and requires identifying a cutoff in infection-host logs.

  • The approach compares infected log sets with logs containing only non-malicious activity to identify features unusually common in infected documents.
  • Log streams are modeled as documents, while selected log entries become terms; entries match when all fields except time and event ID agree.
  • For ransomware pattern generation, the method uses only features before WannaCry creates the private key 00000000.eky.Operators must identify a pre-infection cutoff before applying the method to infection-host logs.
  • TF-IDF combines term frequency with inverse document frequency to rank features frequent in infected logs but infrequent elsewhere.The method preserves human-understandable features for operator interpretation.

A. Analysis of WannaCry & Four Normal Activities

The first experiment compares one WannaCry analysis report with four reports of normal user activities. The highest-ranked TF-IDF features correspond to patterns identified through detailed technical analysis of WannaCry.

  • The experiment uses one malicious WannaCry document and four Cuckoo reports generated from scripts simulating normal user activities.Normal activities include file operations, websites, videos, email, flight searches, and Twitter use.
  • The top-ten TF-IDF weights identify 43 important features that also match WannaCry patterns from detailed executable analysis.

B. Analysis of WannaCry & Varying Normal Activities

The robustness experiment varies the number of normal activity reports while keeping the WannaCry report fixed. The highest ten TF-IDF features and their ranking remain unchanged across the tested document counts.

  • The experiment tests whether WannaCry feature rankings change when the number of normal documents varies.
  • The tested configurations pair one WannaCry report with five, six, or 17 normal performance analysis files.
  • The highest 10 TF-IDF weights and their features are identical across all three normal-activity document counts.

C. Combining Normal Activities with WannaCry

The experiment tests whether TF-IDF can identify WannaCry features when malware behavior is mixed with extensive normal activity. It finds that malware-specific features remain highly ranked, while certain infrequent normal features can create false positives.

  • Mixed normal and malware logs: 1,085 pre-encryption features were produced when normal flight-search activity preceded WannaCry execution, compared with 74 previously.The analysis retained features occurring before the private key was first generated.
  • Mixed normal and malware logs: TF-IDF down-weights features appearing across many normal documents, allowing malware-specific features to remain highly ranked in mixed logs.The experiment compared one mixed report with four normal reports and with 21 normal reports.
  • Mixed normal and malware logs: A Firefox history feature received a TF-IDF weight of 69.1 and outranked many WannaCry-specific features because it was frequent in the malware document but absent from some normal documents.The feature represented reading and writing Firefox’s places.sqlite file.
  • Mixed normal and malware logs: The method can produce false positives if non-malicious features are frequent in the malware-containing document but infrequent elsewhere.This condition is presented as both mathematically provable and empirically verified.

D. Analysis of Polymorphic WannaCry Malware

The polymorphism experiment evaluates whether TF-IDF can identify WannaCry behavior after a minor executable modification defeats antivirus signatures. The supplied passages establish the experimental setup and the method’s continued identification of malware in this case.

  • D. Analysis of Polymorphic WannaCry Malware: Cuckoo Sandbox analyzes the submitted files’ behavioral activities and checks suspicious files against antivirus signatures through VirusTotal.The experiment distinguishes direct WannaCry submission from a Python file combining normal activities with the malware.
  • D. Analysis of Polymorphic WannaCry Malware: The experiment tests whether TF-IDF can identify subtle polymorphism after modifying the WannaCry executable’s hexadecimal content.The changes converted uppercase message letters to lowercase and spaces to hyphens.
  • D. Analysis of Polymorphic WannaCry Malware: None of VirusTotal’s 63 virus databases matched the modified WannaCry executable.The polymorphic sample was submitted to Cuckoo Sandbox using the same technique and normal reports as the first experiment.

V. CONCLUSION AND FUTURE WORK

The paper concludes that its log-based method automatically extracts distinguishing malware features from predominantly ambient logs and remains robust to polymorphism. It also identifies false-indicator conditions, reports stronger WannaCry analysis than Fisher’s method, and outlines operational future work.

  • V. CONCLUSION AND FUTURE WORK: The method automatically extracts accurate distinguishing ransomware features even when ransomware activities are embedded among a majority of non-malicious events.The conclusion reports empirical validation using Cuckoo Sandbox logs across normal and malware scenarios.
  • V. CONCLUSION AND FUTURE WORK: In adverse mixed-log scenarios, some highly ranked features may be spurious, but the majority of the approximately 40 top-ten ranked features are accurate indicators.The paper attributes false indicators to non-malware features occurring in the malware document but relatively infrequently elsewhere.
  • V. CONCLUSION AND FUTURE WORK: TF-IDF gives better results for analyzing WannaCry than Fisher’s Linear Discriminant Analysis while preserving human-understandable features.The paper presents understandable features as a prerequisite for automating malware analysis.
  • V. CONCLUSION AND FUTURE WORK: Future research will integrate the method with other detection systems for automatic pattern generation and enhance autonomic security systems.The authors aim to expedite manual log analysis, malware analysis, and pattern generation from dynamic-analysis tools and host logs.
  • V. CONCLUSION AND FUTURE WORK: WannaCry’s documented behavior includes registry modification, folder hiding, permission changes, key generation, file encryption, and process termination.The technical analysis separates pre-encryption from encryption features based on private-key generation.
Loading 1709.08753v1…