Deep Dive: Kernel-Level Monitoring for Real-Time Malware Behavior Analysis

When it comes to online safety, one of the core components of modern antiviruses such as Kaspersky, BitDefender, OmniDefender, Avast and many more is the kernel-level real-time protection.

Unlike traditional monitoring methods that rely on high-level process observation, kernel-level monitoring allows us to capture low-level interactions between processes and the operating system. This provides detailed insights into how malware behaves in real-time—insights that are invaluable for threat intelligence and improving detection capabilities.

Take a look at this log file for example:

Root Process: C:\Users\Unknown_analysis\documents\Unknown\desktop\0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.exe (PID: 7492) Process created: PID: 1172, ImageName: \??\C:\Windows\System32\cmd.exe, CommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet Process created: PID: 6300, ImageName: \SystemRoot\System32\Conhost.exe, CommandLine: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, Parent PID: 7492, Parent ImageName: \Device\HarddiskVolume3\Users\Malware_Analysis\Desktop\0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.exe File Operations (252314): - Cleanup file: c:\eclipse\features\org.eclipse.mylyn.jenkins.feature_4.3.0.v20240509-0539\feature.properties.lockbit - Cleanup file: c:\eclipse\features\org.eclipse.mylyn.jenkins.feature_4.3.0.v20240509-0539\feature.xml.lockbit - Cleanup file: c:\eclipse\features\org.eclipse.mylyn.jenkins.feature_4.3.0.v20240509-0539\license.html.lockbit - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon, ValueName: Full - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder, ValueName: Attributes - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\UserChoice, ValueName: Hash - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\UserChoice, ValueName: ProgId 

The process 0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.exe seems to have spawned cmd.exe to run some nefarious commands such as:

vssadmin delete shadows /all /quiet: Deletes all Volume Shadow Copies without displaying any prompts

wmic shadowcopy delete: Deletes shadow copies using Windows Management Instrumentation.

bcdedit /set {default} bootstatuspolicy ignoreallfailures: Modifies the boot configuration to ignore failures. This can disable certain recovery options.

bcdedit /set {default} recoveryenabled no: Disables Windows recovery mode.

wbadmin delete catalog -quiet: Deletes the backup catalog, which prevents restoring from backups.

The process queried numerous registry keys related to:

• Windows Explorer settings
• File associations (.inf, .log, .sys)
• Internet settings
• Shell folders

They indicate that the process was gathering system information, these registry queries alone are not inherently malicious.

However it's clear as day that this process is dangerous, and taking a closer inspection shows multiple files with the .lockbit extension were listed under the Eclipse plugins directory, this small segment provides enough information about the process and its behavior.

The log file exceeds several MBs and in size and over 10 lines of API Calls due to the sheer amount activity and damage this ransomware caused.

Volume Shadow Copies is an underutilized tool that is capable of restoring encrypted files which is the reason why most ransomware disable it in order to prevent recovery.

Many antiviruses like Kaspersky, OmniDefender, BitDefender are capable of blocking these malicious behaviors and restore encrypted files to their original state.