res/StateDiagram.svg

<?xml version="1.0" encoding="UTF-8" standalone="no"?><svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" contentScriptType="application/ecmascript" contentStyleType="text/css" height="1440px" preserveAspectRatio="none" style="width:660px;height:1440px;" version="1.1" viewBox="0 0 660 1440" width="660px" zoomAndPan="magnify"><defs><filter height="300%" id="fq3covrjt0ivw" width="300%" x="-1" y="-1"><feGaussianBlur result="blurOut" stdDeviation="2.0"/><feColorMatrix in="blurOut" result="blurOut2" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 .4 0"/><feOffset dx="4.0" dy="4.0" in="blurOut2" result="blurOut3"/><feBlend in="SourceGraphic" in2="blurOut3" mode="normal"/></filter></defs><g><ellipse cx="386.5" cy="18" fill="#000000" filter="url(#fq3covrjt0ivw)" rx="10" ry="10" style="stroke: none; stroke-width: 1.0;"/><g id="CreateFile"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="52.7031" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="218" x="277.5" y="88"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="277.5" x2="495.5" y1="115.6094" y2="115.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="66" x="353.5" y="107.5332">CreateFile</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="198" x="282.5" y="133.0664">Create target file, keep handle open.</text></g><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="40" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="77" x="348" y="201"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="67" x="353" y="226.7285">FileHandle</text><g id="Write"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="52.7031" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="214" x="84.5" y="301"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="84.5" x2="298.5" y1="328.6094" y2="328.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="33" x="175" y="320.5332">Write</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="194" x="89.5" y="346.0664">Write source payload into target file.</text></g><g id="NtCreateSection"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="52.7031" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="197" x="93" y="414"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="93" x2="290" y1="441.6094" y2="441.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="103" x="140" y="433.5332">NtCreateSection</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="177" x="98" y="459.0664">Create section using file handle.</text></g><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="40" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="101" x="139" y="527"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="91" x="144" y="552.7285">SectionHandle</text><g id="NtCreateProcessEx"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="52.7031" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="363" x="6" y="627"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="6" x2="369" y1="654.6094" y2="654.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="122" x="126.5" y="646.5332">NtCreateProcessEx</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="343" x="11" y="672.0664">Image section for process is mapped and cached in file object.</text></g><g id="Modify"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="52.7031" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="152" x="240.5" y="740"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="240.5" x2="392.5" y1="767.6094" y2="767.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="41" x="296" y="759.5332">Modify</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="132" x="245.5" y="785.0664">Obscure the file on disk.</text></g><g id="NtCreateThreadEx"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="67.7969" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="218" x="160.5" y="853"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="160.5" x2="378.5" y1="880.6094" y2="880.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="117" x="211" y="872.5332">NtCreateThreadEx</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="154" x="165.5" y="898.0664">The cached section is used.</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="198" x="165.5" y="913.1602">Process notify routines fire in kernel.</text></g><ellipse cx="305.5" cy="1419" fill="none" filter="url(#fq3covrjt0ivw)" rx="10" ry="10" style="stroke: #000000; stroke-width: 1.0;"/><ellipse cx="306" cy="1419.5" fill="#000000" rx="6" ry="6" style="stroke: none; stroke-width: 1.0;"/><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="40" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="69" x="389" y="1081"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="59" x="394" y="1106.7285">CloseFile</text><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="40" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="200" x="169.5" y="981"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="190" x="174.5" y="1006.7285">PspCallProcessNotifyRoutines</text><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="40" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="128" x="361.5" y="1181"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="118" x="366.5" y="1206.7285">IRP_MJ_CLEANUP</text><g id="Inspect"><rect fill="#FEFECE" filter="url(#fq3covrjt0ivw)" height="67.7969" rx="12.5" ry="12.5" style="stroke: #A80036; stroke-width: 1.5;" width="373" x="239" y="1281"/><line style="stroke: #A80036; stroke-width: 1.5;" x1="239" x2="612" y1="1308.6094" y2="1308.6094"/><text fill="#000000" font-family="sans-serif" font-size="14" lengthAdjust="spacingAndGlyphs" textLength="45" x="403" y="1300.5332">Inspect</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="298" x="244" y="1326.0664">The contents on disk do not match what was executed.</text><text fill="#000000" font-family="sans-serif" font-size="12" lengthAdjust="spacingAndGlyphs" textLength="353" x="244" y="1341.1602">Inspection of the file at this point will result in incorrect attribution.</text></g><!--MD5=[a1738d5aca8b46c42481572a14d05487]
link *start to CreateFile--><path d="M386.5,28.06 C386.5,40.48 386.5,63.4 386.5,82.37 " fill="none" id="*start-&gt;CreateFile" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="386.5,87.61,390.5,78.61,386.5,82.61,382.5,78.61,386.5,87.61" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[386221e18d7c61b8573bac82c683c513]
link CreateFile to FileHandle--><path d="M386.5,141.06 C386.5,157.68 386.5,179.21 386.5,195.58 " fill="none" id="CreateFile-&gt;FileHandle" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="386.5,200.93,390.5,191.93,386.5,195.93,382.5,191.93,386.5,200.93" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[dd089854b98914c15a2dfe6500cd0925]
link FileHandle to Write--><path d="M350.734,241.17 C320.744,257.24 277.518,280.4 243.668,298.54 " fill="none" id="FileHandle-&gt;Write" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="239.167,300.96,248.9896,300.2418,243.5758,298.6015,245.216,293.1877,239.167,300.96" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[9eab5f3f0b9af12c958096e205b635c8]
link FileHandle to NtCreateSection--><path d="M379.527,241.22 C368.905,268.59 346.573,319.3 315.5,354 C295.219,376.65 267.783,396.36 243.875,411.13 " fill="none" id="FileHandle-&gt;NtCreateSection" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="239.454,413.83,249.22,412.5554,243.7218,411.2251,245.0521,405.7269,239.454,413.83" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[37a8eb5f1616ec382f38a3bafaa811a2]
link Write to NtCreateSection--><!--MD5=[15754293e472668ce1999f96ae72d7f9]
link NtCreateSection to SectionHandle--><path d="M191.011,467.064 C190.693,483.675 190.281,505.207 189.967,521.585 " fill="none" id="NtCreateSection-&gt;SectionHandle" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="189.865,526.927,194.0391,518.0064,189.9622,521.9279,186.0406,517.851,189.865,526.927" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[aba031e6424ccb097f08e9c096d28443]
link SectionHandle to NtCreateProcessEx--><path d="M189.133,567.167 C188.843,582.332 188.432,603.814 188.095,621.429 " fill="none" id="SectionHandle-&gt;NtCreateProcessEx" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="187.993,626.761,192.1646,617.8392,188.0887,621.7619,184.166,617.6861,187.993,626.761" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[f4d8fbd12d9e57dcf61bbd23f5b0de61]
link FileHandle to Modify--><path d="M391.812,241.03 C401.826,278.63 422.5,365.25 422.5,439.5 C422.5,439.5 422.5,439.5 422.5,548 C422.5,608.809 414.373,625.955 386.5,680 C375.962,700.433 359.95,720.473 345.898,736.01 " fill="none" id="FileHandle-&gt;Modify" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="342.372,739.86,351.399,735.9212,345.7476,736.1715,345.4974,730.5202,342.372,739.86" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[8080a8aeb559a13c1688f20af762e4ff]
link NtCreateProcessEx to Modify--><!--MD5=[186d73fa168435203317d0f274b37c9d]
link NtCreateProcessEx to NtCreateThreadEx--><path d="M192.192,680.03 C197.773,708.213 208.171,754.669 222.5,793 C229.506,811.742 239.231,831.648 248.018,848.215 " fill="none" id="NtCreateProcessEx-&gt;NtCreateThreadEx" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="250.469,852.795,249.7504,842.9724,248.1104,848.3863,242.6965,846.7462,250.469,852.795" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[f1d1a53f0532ae4b712c9fcd4b0e79db]
link Modify to NtCreateThreadEx--><!--MD5=[53cec411ee98b078e80bf6176ea508b3]
link NtCreateThreadEx to *end--><path d="M214,921.175 C191.83,936.863 167.757,957.358 151.5,981 C120.117,1026.637 114.5,1044.614 114.5,1100 C114.5,1100 114.5,1100 114.5,1202 C114.5,1276.595 144.267,1294.782 195.5,1349 C224.289,1379.4664 269.287,1402.0763 291.761,1412.1702 " fill="none" id="NtCreateThreadEx-&gt;*end" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="296.457,1414.2436,289.84,1406.9487,291.8832,1412.2237,286.6082,1414.2668,296.457,1414.2436" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[84e536d08960129cf758ec0c7a6a9db1]
link FileHandle to CloseFile--><path d="M403.454,241.12 C433.626,277.18 493.5,358.91 493.5,439.5 C493.5,439.5 493.5,439.5 493.5,888 C493.5,959.512 457.141,1038.062 436.831,1076.361 " fill="none" id="FileHandle-&gt;CloseFile" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="434.438,1080.829,442.2144,1074.7852,436.7995,1076.4218,435.1629,1071.0069,434.438,1080.829" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[6892c1e90a827790ce7e2cd1cadc12b3]
link NtCreateThreadEx to CloseFile--><!--MD5=[0d24192707b93bd6429544057bd8a5f7]
link NtCreateThreadEx to PspCallProcessNotifyRoutines--><path d="M269.5,921.3 C269.5,938.796 269.5,959.85 269.5,975.778 " fill="none" id="NtCreateThreadEx-&gt;PspCallProcessNotifyRoutines" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="269.5,980.97,273.5,971.97,269.5,975.97,265.5,971.97,269.5,980.97" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[36540dcc6a8e4fb8bb1f15fd6712b8ec]
link PspCallProcessNotifyRoutines to *end--><!--MD5=[0e9486ba90e233413004542e08f7cdbc]
link CloseFile to IRP_MJ_CLEANUP--><path d="M423.895,1121.362 C424.213,1136.932 424.661,1158.897 425.003,1175.657 " fill="none" id="CloseFile-&gt;IRP_MJ_CLEANUP" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="425.106,1180.679,428.9226,1171.5997,425.0046,1175.68,420.9242,1171.762,425.106,1180.679" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[b180cef86355a088ccd3a2c0b520b8f0]
link IRP_MJ_CLEANUP to *end--><!--MD5=[18276230a825c5744adc59d210a8d7ba]
link PspCallProcessNotifyRoutines to Inspect--><path d="M273.301,1021.229 C281.666,1060.706 304.126,1152.904 343.5,1221 C355.122,1241.099 371.507,1260.771 386.578,1276.807 " fill="none" id="PspCallProcessNotifyRoutines-&gt;Inspect" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="390.378,1280.804,387.0757,1271.5253,386.9329,1277.1803,381.2778,1277.0375,390.378,1280.804" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[5cf5ecd6d91d0c7569d66e23bd798b19]
link PspCallProcessNotifyRoutines to CloseFile--><!--MD5=[ccd1a316e3718411201de0390ea36f9e]
link IRP_MJ_CLEANUP to Inspect--><path d="M425.5,1221.253 C425.5,1236.232 425.5,1257.489 425.5,1275.875 " fill="none" id="IRP_MJ_CLEANUP-&gt;Inspect" style="stroke: #A80036; stroke-width: 1.0;"/><polygon fill="#A80036" points="425.5,1280.977,429.5,1271.977,425.5,1275.977,421.5,1271.977,425.5,1280.977" style="stroke: #A80036; stroke-width: 1.0;"/><!--MD5=[cd6e680f9770c28ac403f9aa2a362d25]
link Inspect to *end--><!--MD5=[876af4b75e7c831d546657da03149934]
@startuml
hide empty description

[*] - -> CreateFile
CreateFile - -> FileHandle
FileHandle - -> Write
FileHandle - -> NtCreateSection
Write -[hidden]-> NtCreateSection
NtCreateSection - -> SectionHandle
SectionHandle - -> NtCreateProcessEx
FileHandle - -> Modify
NtCreateProcessEx -[hidden]-> Modify
NtCreateProcessEx - -> NtCreateThreadEx
Modify -[hidden]-> NtCreateThreadEx
NtCreateThreadEx - -> [*]
FileHandle - -> CloseFile
NtCreateThreadEx -[hidden]-> CloseFile
NtCreateThreadEx - -> PspCallProcessNotifyRoutines
PspCallProcessNotifyRoutines -[hidden]-> [*]
CloseFile - -> IRP_MJ_CLEANUP
IRP_MJ_CLEANUP -[hidden]-> [*]
PspCallProcessNotifyRoutines - -> Inspect
PspCallProcessNotifyRoutines -[hidden]-> CloseFile 
IRP_MJ_CLEANUP - -> Inspect
Inspect -[hidden]-> [*]

CreateFile : Create target file, keep handle open.
Write : Write source payload into target file.
Modify : Obscure the file on disk.
NtCreateSection : Create section using file handle.
NtCreateProcessEx : Image section for process is mapped and cached in file object.
NtCreateThreadEx : The cached section is used.
NtCreateThreadEx : Process notify routines fire in kernel.
Inspect : The contents on disk do not match what was executed. 
Inspect : Inspection of the file at this point will result in incorrect attribution.
@enduml

PlantUML version 1.2020.10(Sun May 17 03:35:57 MDT 2020)
(GPL source distribution)
Java Runtime: Java(TM) SE Runtime Environment
JVM: Java HotSpot(TM) 64-Bit Server VM
Java Version: 1.8.0_261-b12
Operating System: Windows 10
Default Encoding: Cp1252
Language: en
Country: US
--></g></svg>