{"id":552,"date":"2016-09-20T04:59:11","date_gmt":"2016-09-20T04:59:11","guid":{"rendered":"http:\/\/www.adlice.com\/?p=552"},"modified":"2022-12-21T10:36:34","modified_gmt":"2022-12-21T10:36:34","slug":"roguekiller-inside-wmi-scanner","status":"publish","type":"post","link":"https:\/\/www.adlice.com\/es\/roguekiller-inside-wmi-scanner\/","title":{"rendered":"RogueKiller, Inside WMI Scanner"},"content":{"rendered":"\n

 
A few weeks ago you may have seen a new scanner option available in RogueKiller<\/strong>, called WMI Scanner. This new scanner has been added after a few malware started to put themselves into what is called the Windows Management Instrumentation (WMI)<\/strong> database, which is a Microsoft version of the WBEM standard.<\/p>\n\n\n\n


Windows Management Instrumentation (WMI)<\/h2>\n\n\n\n

WMI is explained here<\/strong><\/a> by Microsoft. This is a database model following the WBEM standard<\/strong>, aiming to standardize the way objects are stored<\/strong> in an enterprise (but not only) environment. You can see it as a big database where software can communicate, store information and call each other<\/strong>. Object model is composed of namespaces, classes and class instances<\/strong>. <\/p>\n\n\n\n

There are a bunch of tools to play with the WMI database<\/strong>, one of the best is called WMI Explorer, that you can download here<\/strong><\/a>. For example, this is how we can get the processes list with WMI Explorer:
 
\"wmi1\"<\/a><\/p>\n\n\n\n


WMI Malware<\/h2>\n\n\n\n

Some adware has been seen using the WMI database to store its payload<\/strong> (or malicious code) as well as its persistence item<\/strong>, to make it harder to detect and remove. The adware Yeabests<\/strong> uses ActiveScriptEventConsumer class<\/strong><\/a> to reinfect all desktop shortcuts in order to trigger the infection on web browser launch.<\/p>\n\n\n\n

ActiveScriptEventConsumer is a special WMI class that can run code on a periodic time<\/strong> (like a scheduled task). Since it’s not well known and hidden in the WMI database, no anti-malware was detecting it before that<\/strong>.
 
\"wmi-explorer\"<\/a><\/p>\n\n\n\n


RogueKiller, Inside WMI Scanner<\/h2>\n\n\n\n

RogueKiller now implements<\/a> a WMI Scanner, that iterates and scan each namespace, class and instance for malicious activity<\/strong>. As soon as it’s in the database, the malware will then be removed from the WMI database<\/strong>.
 
\"wmi4\"<\/a><\/p>\n\n\n\n


Links<\/h2>\n\n\n\n