Antiforensics

๐‹๐๐Š ๐„๐ฑ๐ž๐œ๐ฎ๐ญ๐ข๐จ๐ง ๐“๐ข๐ฆ๐ž๐ฌ๐ญ๐š๐ฆ๐ฉ ๐’๐ฉ๐จ๐จ๐Ÿ๐ข๐ง๐  ๐ฏ๐ข๐š ๐…๐ข๐ฅ๐ž๐ง๐š๐ฆ๐ž ๐‚๐จ๐ฅ๐ฅ๐ข๐ฌ๐ข๐จ๐ง

I made two different files: Husam.exe, and Husam.exe in different paths (or instead you can make two MalDoc files with the same name in two paths).

The first Husam.exe is the real malware, while the second Husam.exe is just a benign compiled executable printing "Hello World!" statement.

So, after running both executables, what do you think has happened?!

  1. Two LNK files were generated for Husam.exe and Husam (1).exe

  2. Only one LNK file of Husam.exe was generated.

Choose one. โ˜บ๏ธ

Ok, the right answer may be suprising, but it is 2.

Only one LNK file was generated for Husam.exe

Ok, then guess what I did..

I run first Husam.exe (real malware) and waited a few minutes then run the benign executable..

The LNK file of Husam.exe timestamp was referring to the most recent execution of the benign instance of Husam.exe instead of the first one.

I believe, we can do further research that, but we can use it to spoof the execution timestamp of the real malware producted by LNK files.

So, basically it is anti-forensic timestamp manipulation of LNK artifacts, and I call it: ๐‹๐๐Š ๐„๐ฑ๐ž๐œ๐ฎ๐ญ๐ข๐จ๐ง ๐“๐ข๐ฆ๐ž๐ฌ๐ญ๐š๐ฆ๐ฉ ๐’๐ฉ๐จ๐จ๐Ÿ๐ข๐ง๐  ๐ฏ๐ข๐š ๐…๐ข๐ฅ๐ž๐ง๐š๐ฆ๐ž ๐‚๐จ๐ฅ๐ฅ๐ข๐ฌ๐ข๐จ๐ง

Last updated