The Real Shim Shady

William  Ballenthin , FireEye

Jonathan Tomczak,  Mandiant

1 
Copyright ©   2015, FireEye, Inc.  All rights Copyright ©   2015, reserved.   FireEye, Inc.  All rights reserved  .

Bio, plan

 William Ballenthin, Reverse Engineer

- FLARE (FireEye Labs Advanced Reverse Engineering) team

- Malware analysis, forward and backward engineering

 Jonathan Tomczak, Consultant

- Mandiant Professional Services

- Incident response, forensics, tool development

 Todays Topic: Case Study and Investigative Techniques for Hijacked 
Application Compatibility Infrastructure.

2 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Put out the Fire!

 Working the  malware triage queue, encountered interesting situation:

- Client targeted by phishing emails

- Large deployment FireEye boxes didn’t fire

- Malware maintained persistence, somehow

 What’s going on? How to fix detection & investigative methodology?

3 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

DLL Injection via Shims

 Malware: self -extracting RAR

drops KORPLUG launcher (

loading shellcode backdoor (

 elogger.dat does a little of everything: manually loads PE payload, 
injects, privesc, installs service, HTTP protocol

 Also, installs an ACI shim:

- Writes two (32/64 -bit) hardcoded, embedded SDB files to disk
- Invokes sdbinst.exe

Copyright ©   2015, FireEye, Inc.  All rights reserved

elogger.dll)

elogger.dat)

4 
.

WHAT’S THE ACI?

What are shims and why are they on my system?

Copyright ©  2014, FireEye, Inc.  All rights reservedCopyright ©   2015, FireEye, Inc.  All rights reserved

5 
. CONFIDENTIAL      .

Application Compatibility Infrastructure

 Manages and resolves application compatibility issues with updates to 
Microsoft Windows

 Configured via  freely available Application Compatibility Toolkit (ACT)

 API hooking (& more) built into the executable Loader

- “Shims” typically implemented as code (DLLs) or configuration (disable feature)

- Shims described by databases (SDB files) indicating source and target

- SDBs registered with the OS, queried by loader

6 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Application Compatibility Infrastructure, II

 Targets specified by executable file metadata, including:

- Filename

- PE checksum

- File size

- V ersion info fields, etc.

 Lots of shims to play with

- Dozens of preconfigured  quickfixes (redirect file reads, change heap behavior)

- Thousands of SDB entries distributed by MS

- Some undocumented features

• EMET uses ACI to inject its DLL into processes on execution  
7 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

SDB contents

<EXE>

<NAME type='stringref'>

<APP_NAME type='stringref'>

<VENDOR type='stringref'>Minnesota Educational Computing Corp.</VENDOR>

<EXE_ID type='hex'>568058f1-da4f-4105-8f72-edd5d2a4aaf3</EXE_ID>

<APP_ID type='hex'>82f31111-af62-4849-b866-14c4e748e33c</APP_ID>

<MATCH_MODE type='integer'>0x2</MATCH_MODE>

<MATCHING_FILE>

<NAME type='stringref'>OREGON32.DLL</NAME>

</MATCHING_FILE>

<SHIM_REF>

<NAME type='stringref'>

<SHIM_TAGID type='integer'>0x23298</SHIM_TAGID>

</SHIM_REF>

</EXE>

Copyright ©   2015, FireEye, Inc.  All rights reserved

OREGON32.EXE</NAME>

The Oregon Trail v1.2

EmulateGetDiskFreeSpace

.

</APP_NAME>

</NAME>

8

SHIM TECHNIQUES

Shim development, creation, and deployment

Copyright ©  2014, FireEye, Inc.  All rights reservedCopyright ©   2015, FireEye, Inc.  All rights reserved

9 
. CONFIDENTIAL      .

The Application Compatibility Toolkit

10 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

SDB deployment

 sdbinst.exe registers SDB files with operating system

- Creates uninstallation entries in the control panel

- Add values to Registry keys:  
• HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\AppCompatFlags\Custom 
• HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\AppCompatFlags\InstalledSDB

 Microsoft recommends packaging in an MSI and deploying via GPO

 Directly adding the Registry values circumvent  sdbinst.exe and extra 
control panel entries

11 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Fun shims

Shim Name

DisableWindowsDefender

CorrectFilePaths

LoadLibraryRedirectFlag

NoSignatureCheck

RelaunchElevated

TerminateExe

VirtualRegistry

Copyright ©   2015, FireEye, Inc.  All rights reserved

Purpose

“The fix disables Windows Defender for 
security applications that do not work with 
Windows Defender.”

Redirect  file system paths

Change load directory of DLLs

???  

Ensure an EXE runs as  admin

???  

Registry

.

redirection and expansion

12

Trick 1: DLL Injection via shims (seen in wild)

 Self -extracting RAR

drops KORPLUG launcher (

loading shellcode backdoor (

 elogger.dat does some of everything: manually loads PE payload, 
injects, privesc, installs service, HTTP protocol

 Also, installs an ACI shim:

- Writes two (32/64 -bit) hardcoded, embedded SDB files to disk
- Invokes sdbinst.exe

Copyright ©   2015, FireEye, Inc.  All rights reserved

elogger.dll)

elogger.dat)

.

13

SDB contents

<DATABASE><NAME type='stringref'>

<DATABASE_ID type='guid'>

<LIBRARY> <SHIM>

<NAME type='stringref'>

<DLLFILE type='stringref'>

</SHIM></LIBRARY>

<EXE>

<NAME type='stringref'>

<APP_NAME type='stringref'>

<EXE_ID type='hex'>e8cc2eb6-469d-43bc-9d6a-de089e497303

<MATCHING_FILE><NAME type='stringref'>*

<SHIM_REF><NAME type='stringref'>

</EXE></DATABASE>

Copyright ©   2015, FireEye, Inc.  All rights reserved

Brucon_Database

503ec3d4-165b-4771-b798-099d43b833ed</

Brucon_Shim</NAME>

Custom\elogger.dll

svchost.exe</NAME>

Brucon_Apps</APP_NAME>

</NAME></MATCHING_FILE>

Brucon_Shim

.

</NAME>

DATABASE_ID>

</DLLFILE>

</EXE_ID>

</NAME></SHIM_REF>

14

Analysis

 Persistence configured via opaque file format

 Hardcoded SDB file easily sig -able via filenames, IDs

- Payload file exists in the clear, in very limited set of directories

• C:\Windows\AppPatch\Custom\

• C:\Windows\AppPatch\Custom\Custom64\

 FireEye identified filename  elogger.dll
SOGU campaigns.

Copyright ©   2015, FireEye, Inc.  All rights reserved .

often reused in KORPLUG &

15

Trick 2: Argument replacement via shims (seen in lab)

 CorrectFilePath fix redirects arguments from the application’s path to 
an attacker’s specified path

- Trivial to hook into CreateProcess,

 Custom program mine.exe, launches

- Add shim: redirects  C:\windows\temp\1.exe to

- CorrectFilePath: “C:\windows\temp\1.exe; C:\dump\

Copyright ©   2015, FireEye, Inc.  All rights reserved .

WinExec, ShellExecute

C:\windows\temp\1.exe

C:\dump\1.exe

1.exe”

16

SDB contents

<DATABASE><TIME type='integer'>0x1d100fac0a4a7fc</TIME> 
  <NAME type='stringref'>minesdb
  <DATABASE_ID type='guid'> 
      2840a82e-91ff-4f29-bff2-fd1e9780b6eb</DATABASE_ID> 
  <EXE> 
    <APP_NAME type='stringref'>
    <MATCHING_FILE><NAME type='stringref'>*
    <SHIM_REF> 
      <NAME type='stringref'>
      <COMMAND_LINE type='stringref'> 
     "C:\Windows\Temp\1.exe; C:\dump\
      </COMMAND_LINE> 
    </SHIM_REF></EXE></DATABASE>

Copyright ©   2015, FireEye, Inc.  All rights reserved

</NAME>

mine.exe

CorrectFilePaths

.

</APP_NAME> 
</NAME></MATCHING_FILE>

</NAME>

1.exe“

17

Trick 2: Argument replacement via shims, II

 Analysis:

- Consider the targeted process is  cmd.exe

• Hidden persistence, MITM of process creation

• #DFIR confusion

- Configured  via opaque file format

- Payload not limited to specific directories

18 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Trick 3: Shellcode injection via shims (seen in wild)

 Phishing email leads to dropper

dropper installs template SDB and modifies them dynamically

SDB declares shellcode that it injects on executable load

payload is a downloader for other stages

 First identified by TrendMicro…

Copyright ©   2015, FireEye, Inc.  All rights reserved .

19

SDB contents

<DATABASE><NAME type='stringref'>opera.exe</NAME> 
  <DATABASE_ID> 
        538f5e1c-932e-4426-b1c9-60a6e15bcd7f
  <LIBRARY><SHIM_REF><PATCH> 
        <NAME type='stringref'>
        <PATCH_BITS type='hex'>
  </PATCH></SHIM_REF></LIBRARY> 
  <EXE><APP_NAME type='stringref'>
    <MATCHING_FILE><NAME>opera.exe
    <PATCH_REF> 
      <NAME type='stringref'>
      <PATCH_TAGID type='integer'>0x6c</PATCH_TAGID> 
    </PATCH_REF></EXE></DATABASE>

Copyright ©   2015, FireEye, Inc.  All rights reserved

patchdata0
040000c…0000000000000000

</DATABASE_ID>

</NAME> 
</PATCH_BITS>

opera.exe</APP_NAME> 
</NAME></MATCHING_FILE>

patchdata0</NAME>

20 
.

PATCH_BITS

 Windows loader writes arbitrary bytes into module memory

- PATCH_MATCH to verify target of memory write

- PATCH_REPLACE stamps in raw bytes

- Can target both EXE and DLL modules

21 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Patch details

00000000 (04)   opcode: PATCH_MATCH

0000000c (04)   rva: 0x00053c2e

00000014 (64)   module_name: 
u'kernel32.dll'

00000054 (05)   pattern: 9090909090

disassembly:

0x53c2e: nop

0x53c2f: nop

0x53c30: nop

0x53c31: nop

0x53c32: nop

Copyright ©   2015, FireEye, Inc.  All rights reserved

00000000 (04)   opcode: PATCH_REPLACE

0000000c (04)   rva: 0x00053c2e

00000014 (64)   module_name:

u'kernel32.dll'

00000054 (07)   pattern: e8321a0700ebf9

disassembly:

0x53c2e: call 0x000c5665

0x53c33: jmp 0x00053c29

22 
.

Patch details, II

00000000 (04)   opcode: PATCH_MATCH

0000000c (04)   rva: 0x000c5665

00000014 (64)   module_name:

u'kernel32.dll'

00000054 (08)   pattern:

0000000000000000

Copyright ©   2015, FireEye, Inc.  All rights reserved

00000000 (04)   opcode: PATCH_REPLACE

0000000c (04)   rva: 0x000c5665

00000014 (64)   module_name: u'kernel32.dll'

00000054 (14)   pattern: 
83042402609ce8030000009d61c3

disassembly:

0xc5665: add dword [esp],2

0xc5669: pushad

0xc566a: pushfd

0xc566b: call 0x000c566d

0xc5670: popfd

0xc5671: popad

0xc5672: ret   23 
.

Patch details, III

< Multi-

Copyright ©   2015, FireEye, Inc.  All rights reserved

kilobyte shellcode downloader >

24 
.

Patch details, summary

Legit Call

Kernel32.dll   Legit Code

Legit Call

Legit Code

25 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Patch details, summary

Legit Call

Kernel32.dll

Hook

Legit Call

Copyright ©   2015, FireEye, Inc.  All rights reserved .

Legit Code

Legit Code

26

Patch details, summary

Trampoline

Copyright ©   2015, FireEye, Inc.  All rights reserved

Legit Call

Kernel32.dll   Legit Code

Legit Call

Legit Code

27 
.

Patch details, summary

Legit Call

Kernel32.dll

Legit Call

Fetch & exec 
backdoor

Copyright ©   2015, FireEye, Inc.  All rights reserved .

Legit Code

Legit Code

28

Patch details, summary

Legit Call

Kernel32.dll

Return to trampoline

Legit Call

Copyright ©   2015, FireEye, Inc.  All rights reserved .

Legit Code

Legit Code

29

Patch details, summary

Legit Call

Kernel32.dll

Return to legit code

Legit Call

Copyright ©   2015, FireEye, Inc.  All rights reserved .

Legit Code

Legit Code

30

Patch details, summary

Legit Call

Kernel32.dll   Legit Code

Legit Call

Legit Code

31 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Analysis

 Persistence & injection  by MS  infrastructure!

 External  storage of shellcode in opaque format

 Dynamic modification of SDB files from template

- Generates unique GUIDs for database ID

- Extensible payloads

- PATCH_BYTES not documented

32 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

FLYING THROUGH THE MATRIX

Understanding SDB files

33  
Copyright ©  2014, FireEye, Inc.  All rights reservedCopyright ©   2015, FireEye, Inc.  All rights reserved. CONFIDENTIAL      .

SDB file format

 The SDB file format is an undocumented Microsoft format

- apphelp.dll exposes ~254 exports for manipulating shims

- That doesn’t help for forensic analysis!

34  
Copyright ©   2015, FireEye, Inc.  All rights reserved .

SDB file format, II

 So, we reverse engineered it

 Conceptually, like an indexed XML document

- Three main nodes: the index, the database structure, and a string table

- No compression, encryption, signatures, nor checksums

35  
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Consider the scenario

 Shim definition: name & shim action
  <LIBRARY> <SHIM> 
      <NAME type='stringref'>
      <DLLFILE type='stringref'>
  </SHIM></LIBRARY>

 Application definition: target & shim pointer
  <NAME type='stringref'>
  <APP_NAME type='stringref'>
  <SHIM_REF> 
    <NAME type='stringref'>
    <SHIM_TAGID type='integer'>0x47c</SHIM_TAGID> 
  </SHIM_REF>

Copyright ©   2015, FireEye, Inc.  All rights reserved

Brucon_Shim</NAME> 
Custom\elogger.dll</DLLFILE>

svchost.exe</NAME> 
Brucon_Apps</APP_NAME>

Brucon_Shim</NAME>

36  
.

python-sdb

 Some tools exist for unpacking SDB files

- But they rely on the Windows API

 python-sdb is a cross platform, pure Python library for parsing SDBs

- Python API makes it easy to build scripts that inspect SDB features

- Provided sample scripts dump database as various XML flavors

 https:// github.com/williballenthin/python

Copyright ©   2015, FireEye, Inc.  All rights reserved .

-sdb

37

DETECTION METHODOLOGY

Investigating malicious shims at scale in a large environment

38  
Copyright ©  2014, FireEye, Inc.  All rights reservedCopyright ©   2015, FireEye, Inc.  All rights reserved. CONFIDENTIAL      .

Consider the scenario

 Trojan.mambashim

- Python (what, just read the source !?!)

- Obfuscated bytecode

- Installs service, or uses ctypes to dynamically create sdb and install

- sdb causes Windows loader to inject DLL payload launcher into

Would you have any idea this was happening to your environment?

Copyright ©   2015, FireEye, Inc.  All rights reserved .

putty44.exe

39

Existing administrative tools?

 Fact:  Trojan.mambashim generates random sdb path using a dictionary 
of English words, installs using  sdbinst.exe

 ACI Fails:







 Win?



No  central management for SDBs on a system

No Active Directory  tools for SDB management

No  accounting of ACI changes or  rollback features

Maybe catch sdbinst.exe via process auditing?

40 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

ACI Integrity checking?

 SDB files are not signed  

 Whitelisting SDBs by hash does

 eg. collection across 6,000 hosts yields 18,000 unique SDB

 Embedded timestamps and installation order affect SDB integrity checks

 If Office is installed before Visual Studio, and then vice versa on 
another system, it may result in a different SDB.

Copyright ©   2015, FireEye, Inc.  All rights reserved .

not work

files

41

Mass inspection & anomaly detection

 Acquire, inspect %systemdrive%\*.sdb

 Legitimate SDBs typically reside in  Windows and Program Files

 Attacker SDBs found in  %USERSPROFILE%, working directories

 Acquire, inspect 
 HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\AppCompatFlags\Custom 
 HKLM\SOFTWARE\Microsoft\Windows 
NT\CurrentVersion\AppCompatFlags\InstalledSDB

 Default sdbs:  drvmain, frxmain, msimain, pcamain, sysmain 
 
42 
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Mass inspection & anomaly detection

 Trojan.mambashim

- Random header timestamp (range 0

- Random compiler version (

- EXE vendor name  vendor

- Random database ID (well, it’s a GUID…) 👍

- Random  EXE ID (also  GUID…)

 But, blacklist won’t scale

 Good for hunting, not fire and forget

rand.rand.rand.rand)

👍

👍

-max int64 (!!!))  👍

👍

43  
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Mass inspection & anomaly detection, II

Microsoft-Windows-Application-Experience-Program-Telemetry.evtx

Compatibility fix applied to

Fix information: vendor, {7e4053fe-ade9-426f-9dc2-0bbfa76b5366}, 
0x80010156.

 Do you have technology that can detect “unusual entries”?

- Count tuple (hostname, vendor, application) & sort ASC

- Alert on new tuples?

Copyright ©   2015, FireEye, Inc.  All rights reserved

C:\PROGRAM FILES\Putty\putty44.exe.

44  
.

Domain specific hashing

 Realistically,  Trojan.mambashim could be much nastier.

 We don’t expect blacklisting to scale, that’s just playing catch up

 We really want to whitelist:

 But, can’t whitelist entire files by hash (see earlier)

 Can hash shim & application definitions

 Don’t expect these to change

 Use this to build a whitelist!

 shims_hash_shims.py

45  
Copyright ©   2015, FireEye, Inc.  All rights reserved .

Prepare for this scenario

 https://github.com/ganboing/sdb_packer

 Extract existing legit  sysmain.sdb

 Add new shim for explorer.exe

 Payload:  keylog data & shellcode that does

 Re -pack sysmain.sdb

 Deploy

 ???

 Profit

Copyright ©   2015, FireEye, Inc.  All rights reserved .

, etc.

exfil

46

Shims are real. Don’t get shimmed.

 Both targeted and commodity threats are actively using ACI shims

 There is no existing infrastructure for detection

 Consider the risk

 You are now the front line.

Copyright ©   2015, FireEye, Inc.  All rights reserved

47 
.

Prior work

 “Persist It - Using and Abusing Microsoft Fix It Patches” 
@ BH ’14 
https://www.blackhat.com/docs/asia -14/materials/Erickson/Asia -14 -Erickson -Persist -It-Using-And-Abusing-Microsofts-Fix-It-
Patches.pdf

 “Shim: A new method of injection” (in Russian) 
ftp://os2.fannet.ru/fileechoes/programming/XA_159.PDF

 “Roaming Tiger” - Anton Cherepanov /ESET @  ZeroNights
http:// 2014.zeronights.org/assets/files/slides/roaming_tiger_zeronights_2014.pdf

 “Windows - Owned By Default !” – Mark Baggett @  DerbyCon

 “Compatibility  Fix Descriptions” - MSDN                                      
https://technet.microsoft.com/en -us/library/cc722305%28v=ws.10%29.aspx

Copyright ©   2015, FireEye, Inc.  All rights reserved .

- Jon Erickson/ iSIGHT

’14

2013

48

THE END

Questions?

Copyright ©  2014, FireEye, Inc.  All rights reservedCopyright ©   2015, FireEye, Inc.  All rights reserved 49  
. CONFIDENTIAL      .

File Timestamp Indicators

 Filesystem created timestamp indicates installation of SDB

 Windows Patch

 Application Install

 Malicious SDB that was pre

 Registry timestamps show installation

 Filesystem modified timestamp indicates that the SDB

 Windows Patch

 Application Install

 Malicious injection into an existing SDB such as

Copyright ©   2015, FireEye, Inc.  All rights reserved

-compiled before installation.

timestamp

.

to the system

was recompiled.

sysmain.sdb

50

Notes on artifacts

 FireEye identified filename  elogger.dll
campaigns.

 elogger.dll exports ShimMain 
shim entry points. Some KORPLUG loaders also export these without SOGU 
payloads referencing the ACI.

 “Roaming Tiger” (ESET) campaign distributed SDB files with similar naming schemes:

elogger.dat 
Brucon_Shim 
Brucon_Apps 
Brucon_Database

Copyright ©   2015, FireEye, Inc.  All rights reserved

often reused in KORPLUG & SOGU

and NotifyShims, which are undocumented

“Roaming Tiger” 
AcProtect_Shim 
AcProtect_Apps 
AcProtect_Database

51 
.

Shim DLL exports

Shim DLL export name

SE_DllLoaded

SE_DLLUnloaded

SE_DynamicShim

SE_GetProcAddress

SE_InstallAfterInit

SE_InstallBeforeInit

SE_IsShimDLL

SE_Process

Copyright ©   2015, FireEye, Inc.  All rights reserved

Shim DLL export purpose

Callback during DLL load

Callback during DLL unload

Unknown

Callback during 
GetProcAddress

Callback after shim 
complete

Callback before shim 
application

Callback when shimming shim 
DLL

Callback when EXE exiting

52 
.