Process Ghosting. Circumvent antiviruses in the most dangerous way

Process Ghosting is one of the most relevant techniques nowadays. Using it, an attacker can run malicious code from an already deleted file. Process Ghosting is frequently used in combat malware. But to understand how it works, let’s go through the basics first.

This article frequently mentions NTAPI functions. As you are likely aware, they cannot be just called; instead, you have to run them dynamically from ntdll.dll.

EDR (Endpoint Detection and Response)

EDR tools often use various functions to monitor process creation, including:

• PsSetCreateProcessNotifyRoutineEx;
• PsSetCreateProcessNotifyRoutineEx2; and 
• PsSetCreateProcessNotifyRoutine.

The file is scanned at startup, or more precisely, at the time of process creation. Below are the prototypes of the above-listed functions:

Important: scan occurs precisely when the process starts, not in any other situation. This is done to save computational resources: otherwise, scanning all files in the system would take a very long time, especially during write operations.

For EDR, everything seems to be fine if a process is created using the NtCreateUserProcess function (a modern NTAPI first introduced in Windows Vista): it performs almost all actions required to create a process and its first thread. All steps are performed in its context: the first thread of the process is created, callbacks from PsSetCreateProcessNotifyRoutineEx are called, and so on. It’s really difficult to affect these procedures from the outside. Most importantly, EDR protection tools are effective only in this scenario because they expect the process to be created using NtCreateUserProcess.

In a similar way, NTAPI can be called by standard APIs such as CreateProcess (CreateProcess → CreateProcessInternalW → NtCreateUserProcess) or RtlCreateUserProcess (RtlCreateUserProcessEx → RtlpCreateUserProcess → NtCreateUserProcess). In other words, even if you write code using WinAPI (which is a pretty rare thing nowadays), the ‘correct’ NtCreateUserProcess function will still be called, thus, satisfying requirements of EDR tools.

But everything changes if you create a process using the NtCreateProcessEx function. It’s older than NtCreateUserProcess and was left in Windows for backward compatibility. The point is that this function makes it possible to create a process in a more ‘manual’ way: you can affect the creation of threads and run them from user mode. Furthermore, this operation is possible even if you replace or delete files and processes or set the required flags (which is what you actually do). As a result, your executable code remains only in memory and avoids scanning because it has already been deleted from the hard drive before the creation of its first thread.

Coding

Done with theory, let’s start programming. The following steps are required to implement Process Ghosting.

First, you have to create a temporary file that will be subsequently deleted. I am going to create such a file using the NtCreateFile NTAPI function (don’t forget to grant it the required rights: delete, write, etc.). And, of course, this file should be stored in the folder for temporary files.

Next, you have to mark this file as ready to be deleted. For this purpose, use the NtSetInformationFile function and set the value of the last argument to FileDispositionInformation. This will add the DeletePending flag to your file. Since that moment, the operating system will be ready to delete this temporarty file as soon as its handle is closed.

Now write the code (function NtWriteFile) you want to be executed bypassing monitoring tools into your temporary file.

Then you have to create a section object from your temporary file by calling the NtCreateSection function. Don’t forget to set the correct function arguments: PAGE_READONLY and SEC_IMAGE (they will indicate that you are dealing with an executable image file).

Now you can close the temporary file handle by calling NtClose. Since this temporary file was created with the DeletePending flag, as soon as the handle is closed, the OS immediately deletes the file.

The next step is to create a process from your section. As a result, you get a handle to a new process, which will be subsequently used to create a thread inside your process.

To enable your thread to run in the OS, you have to configure PEB and process parameters.

First, let’s take care of the parameters:

Writing the parameters to the process (I omit endless if statements required to check call correctness):

Time to configure PEB. In fact, this is a standard procedure implemented when such processes are started using NtCreateProcessEx and similar functions. It’s present in any code and isn’t specific to Process Ghosting.

Creating the first thread in your process using the NtCreateThreadEx function:

Conclusions

Congrats! Now you can covertly start processes using Process Ghosting! But it’s too early to rest on the laurels. Techniques used to hide code execution are just the first step towards full ‘invisibility’. In addition, this trick leaves some artifacts in memory (although other techniques can be applied to avoid detection). I am going to continue this series of publications; so, see you soon!