{"id":8757,"date":"2021-09-27T03:33:26","date_gmt":"2021-09-27T01:33:26","guid":{"rendered":"https:\/\/tajdini.net\/blog\/?p=8757"},"modified":"2021-09-27T03:33:27","modified_gmt":"2021-09-27T01:33:27","slug":"windows-processes-investigation","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/dfir-and-incident-response\/windows-processes-investigation\/","title":{"rendered":"Windows Processes Investigation"},"content":{"rendered":"\n

smss.exe<\/a><\/h2>\n\n\n\n

It’s called Session Manager<\/strong>. Session 0 starts csrss.exe<\/strong> and wininit.exe<\/strong> (OS<\/strong> services<\/strong>) while Session 1 starts csrss.exe<\/strong> and winlogon.exe<\/strong> (User<\/strong> session<\/strong>). However, you should see only one process<\/strong> of that binary<\/strong> without children in the processes tree. Also, more sessions apart from 0 and 1 may mean that RDP sessions are occurring.<\/p>\n\n\n\n

csrss.exe<\/a><\/h2>\n\n\n\n

Is the Client\/Server Run Subsystem Process<\/strong>. It manages processes<\/strong> and threads<\/strong>, makes the Windows<\/strong> API<\/strong> available for other processes and also maps<\/strong> drive<\/strong> letters<\/strong>, create temp<\/strong> files<\/strong> and handles the shutdown<\/strong> process<\/strong>. There is one running in Session 0 and another one in Session 1<\/strong> (so 2 processes<\/strong> in the processes tree). Another one is created per new Session<\/strong>.<\/p>\n\n\n\n

winlogon.exe<\/a><\/h2>\n\n\n\n

This is Windows Logon Process. It’s responsible for user logon<\/strong>\/logoffs<\/strong>. It launches logonui.exe<\/strong> to ask for username and password and then calls lsass.exe<\/strong> to verify them. Then it launches userinit.exe<\/strong> which is specified in HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon<\/strong><\/code> with key Userinit<\/strong>. Mover over, the previous registry should have explorer.exe<\/strong> in the Shell key<\/strong> or it might be abused as a malware persistence method<\/strong>.<\/p>\n\n\n\n

wininit.exe<\/a><\/h2>\n\n\n\n

This is the Windows Initialization Process<\/strong>. It launches services.exe<\/strong>, lsass.exe<\/strong> and lsm.exe<\/strong> in Session 0. There should only be 1 process.<\/p>\n\n\n\n

userinit.exe<\/a><\/h2>\n\n\n\n

Load the ntduser.dat in HKCU<\/strong> and initialises the user<\/strong> environment<\/strong> and runs logon<\/strong> scripts<\/strong> and GPO<\/strong>. It launches explorer.exe<\/strong>.<\/p>\n\n\n\n

lsm.exe<\/a><\/h2>\n\n\n\n

This is the Local Session Manager<\/strong>. It works with smss.exe to manipulate use sessions: Logon\/logoff, shell start, lock\/unlock desktop… After W7 lsm.exe was transformed into a service (lsm.dll). There should only be 1 process in W7 and from them a service running the DLL.<\/p>\n\n\n\n

services.exe<\/a><\/h2>\n\n\n\n

This is the Service Control Manager<\/strong>. It loads<\/strong> services<\/strong> configured as auto-start<\/strong> and drivers<\/strong>.<\/p>\n\n\n\n

It’s the parent process of svchost.exe<\/strong>, dllhost.exe<\/strong>, taskhost.exe<\/strong>, spoolsv.exe<\/strong> and many more. Note that services are defined in HKLM\\SYSTEM\\CurrentControlSet\\Services<\/code> and this process maintains a DB in memory of service info that can be queried by sc.exe.<\/p>\n\n\n\n

Note how some<\/strong> services<\/strong> are going to be running in a process of their own<\/strong> and others are going to be sharing a svchost.exe process<\/strong>.<\/p>\n\n\n\n

There should only be 1 process.<\/p>\n\n\n\n

lsass.exe<\/a><\/h2>\n\n\n\n

This the Local Security Authority Subsystem<\/strong>. It’s responsible for the user authentication<\/strong> and create the security<\/strong> tokens<\/strong>. It uses authentication packages located in HKLM\\System\\CurrentControlSet\\Control\\Lsa<\/code>. It writes to the Security<\/strong> event<\/strong> log<\/strong>. There should only be 1 process. Keep in mind that this process is highly attacked to dump passwords.<\/p>\n\n\n\n

svchost.exe<\/a><\/h2>\n\n\n\n

This is the Generic Service Host Process<\/strong>. It hosts multiple DLL services in one shared process. Usually you will find that svchost.exe<\/strong> is launched with -k<\/code> flag. This will launch a query to the registry HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost <\/strong>where there will be a key with the argument mentioned in -k that will contain the services to launch in the same process.<\/p>\n\n\n\n

For example: -k UnistackSvcGroup<\/code> will launch: PimIndexMaintenanceSvc MessagingService WpnUserService CDPUserSvc UnistoreSvc UserDataSvc OneSyncSvc<\/code><\/p>\n\n\n\n

If the flag <\/strong>-s<\/code><\/strong> is also used with an argument, then svchost is asked to only launch the specified service<\/strong> in this argument.<\/p>\n\n\n\n

There will be several process of svchost.exe<\/code>. If any of them is not using the <\/strong>-k<\/code><\/strong> flag<\/strong>, then thats very suspicious. If you find that services.exe is not the parent<\/strong>, thats also very suspicious.<\/p>\n\n\n\n

taskhost.exe<\/a><\/h2>\n\n\n\n

This process act as host for processes run from DLLs. It loads the services that are run from DLLs. In W8 is called taskhostex.exe and in W10 taskhostw.exe.<\/p>\n\n\n\n

explorer.exe<\/a><\/h2>\n\n\n\n

This is the process responsible for the user’s desktop<\/strong> and launching files via file extensions. Only 1<\/strong> process should be spawned per logged on user.<\/strong> This is run from userinit.exe<\/strong> which should be terminated, so no parent <\/strong>should appear for this process.<\/p>\n\n\n\n

Catching Malicious Processes<\/a><\/h1>\n\n\n\n
  • Is it running from the expected path? (No Windows binaries run from temp location)<\/li>
  • Is it communicating with weird IPs?<\/li>
  • Check digital signatures (Microsoft artefacts should be signed)<\/li>
  • Is it spelled correctly?<\/li>
  • Is running under the expected SID?<\/li>
  • Is the parent process the expected one (if any)?<\/li>
  • Are the children processes the expecting ones? (no cmd.exe, wscript.exe, powershell.exe..?)<\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"

    smss.exe It’s called Session Manager. Session 0 starts csrss.exe and wininit.exe (OS services) while Session 1 starts csrss.exe and winlogon.exe (User session). However, you should see […]<\/p>\n","protected":false},"author":1,"featured_media":8758,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[224,235],"tags":[179,180,176],"class_list":["post-8757","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-dfir-and-incident-response","category-windows-and-server","tag-dfir","tag-rdp","tag-windows"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8757","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8757"}],"version-history":[{"count":1,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8757\/revisions"}],"predecessor-version":[{"id":8759,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8757\/revisions\/8759"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media\/8758"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8757"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8757"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8757"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}