You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -25,15 +25,15 @@ The dynamic configuration system allows to hide processes by **PID** and by **na
25
25
26
26
The configuration is located in `HKEY_LOCAL_MACHINE\SOFTWARE\$77config` and is writable by any process without elevated privileges. The DACL of this key is set to grant full access to any user.
27
27
28
-
The `$77config` key is hidden when RegEdit is injected with the rootkit.
28
+
In addition, the `$77config` key is hidden by the rootkit.
29
29
30
30
## Installer
31
31
32
-
r77 is deployable using a single file`"Install.exe"`. The installer persists r77 and injects all currently running processes.
32
+
The deployment of r77 requires only one file: `Install.exe`. Execution persists r77 on the system and injects all running processes.
33
33
34
-
`Uninstall.exe` removes r77 from the system and gracefully detaches the rootkit from all processes.
34
+
`Uninstall.exe` removes r77 from the system completely, and gracefully.
35
35
36
-
`Install.shellcode` is the shellcode equivalent of the installer. This way, the installer can be integrated without dropping `Install.exe`. It can simply be loaded into memory, casted to a function pointer, and executed:
36
+
`Install.shellcode` is the shellcode equivalent of the installer. This way, the installation can be integrated without dropping `Install.exe`. The shellcode can simply be loaded into memory, casted to a function pointer, and executed:
37
37
38
38
```
39
39
int main()
@@ -55,16 +55,6 @@ int main()
55
55
}
56
56
```
57
57
58
-
## Child process hooking
59
-
60
-
When a process creates a child process, the new process is injected before it can run any of its own instructions. The function `NtResumeThread` is always called when a new process is created. Therefore, it's a suitable target to hook. Because a 32-bit process can spawn a 64-bit child process and vice versa, the r77 service provides a named pipe to handle child process injection requests.
61
-
62
-
In addition, there is a periodic check every 100ms for new processes that might have been missed by child process hooking. This is necessary because some processes are protected and cannot be injected, such as services.exe.
63
-
64
-
## In-memory injection
65
-
66
-
The rootkit DLL (`r77-x86.dll` and `r77-x64.dll`) can be injected into a process from memory and doesn't need to be stored on the disk. **Reflective DLL injection** is used to achieve this. The DLL provides an exported function that when called, loads all sections of the DLL, handles dependency loading and relocations, and finally calls `DllMain`.
67
-
68
58
## Fileless persistence
69
59
70
60
The rootkit resides in the system memory and does not write any files to the disk. This is achieved in multiple stages.
@@ -88,6 +78,16 @@ No executables or DLL's are ever stored on the disk. The stager is stored in the
88
78
89
79
The PowerShell and .NET dependencies are present in a fresh installation of Windows 7 and Windows 10. Please review the [documentation](https://docs.bytecode77.com/r77-rootkit/Technical%20Documentation.pdf) for a complete description of the fileless initialization.
90
80
81
+
## Child process hooking
82
+
83
+
When a process creates a child process, the new process is injected before it can run any of its own instructions. The function `NtResumeThread` is always called when a new process is created. Therefore, it's a suitable target to hook. Because a 32-bit process can spawn a 64-bit child process and vice versa, the r77 service provides a named pipe to handle child process injection requests.
84
+
85
+
In addition, there is a periodic check every 100ms for new processes that might have been missed by child process hooking. This is necessary because some processes are protected and cannot be injected, such as services.exe.
86
+
87
+
## In-memory injection
88
+
89
+
The rootkit DLL (`r77-x86.dll` and `r77-x64.dll`) can be injected into a process from memory and doesn't need to be stored on the disk. **Reflective DLL injection** is used to achieve this. The DLL provides an exported function that when called, loads all sections of the DLL, handles dependency loading and relocations, and finally calls `DllMain`.
90
+
91
91
## Hooking
92
92
93
93
Detours is used to hook several functions from `ntdll.dll`. These low-level syscall wrappers are called by **any** WinAPI or framework implementation.
@@ -102,18 +102,16 @@ Detours is used to hook several functions from `ntdll.dll`. These low-level sysc
102
102
- EnumServicesStatusExW
103
103
- NtDeviceIoControlFile
104
104
105
-
The only exception is `advapi32.dll` and `sechost.dll`. These functions are hooked to hide services. This is because the actual service enumeration happens in services.exe, which cannot be injected.
106
-
107
105
## AV/EDR evasion
108
106
109
107
Several AV and EDR evasion techniques are in use:
110
108
111
-
-**AMSI bypass:** The PowerShell inline script disables AMSI by patching `amsi.dll!AmsiScanBuffer` to always return `AMSI_RESULT_CLEAN`.
109
+
-**AMSI bypass:** The PowerShell inline script disables AMSI by patching `amsi.dll!AmsiScanBuffer` to always return `AMSI_RESULT_CLEAN`. Polymorphism is used to evade signature detection of the AMSI bypass.
112
110
-**DLL unhooking:** Since EDR solutions monitor API calls by hooking `ntdll.dll`, these hooks need to be removed by loading a fresh copy of `ntdll.dll` from disk and restoring the original section. Otherwise, process hollowing would be detected.
113
111
114
112
## Test environment
115
113
116
-
The Test Console can be used to inject r77 to or detach r77 from individual processes.
114
+
The Test Console is a useful tool to inject r77 into individual processes and to test drive the configuration system.
0 commit comments