Defenders Arise: Examining 7Zip data extraction with Registry analysis
Brief
As I perused the articles of the week, as I do , one from Hackers Arise came up and rang some alarm bells. I had a case last year where the attackers jumped onto a domain controller, ran 7Zip, and ran off with the NTDS. We had no idea how they did it, just that NTDS. 7z was created in the users folder and, well, incident response ensued.
This article was pretty interesting – basically if you type “\\. \” into address bar in 7-Zip you are met with a way of accessing the physical device. Now, I shouldn’t be surprised – 7-Zip has a way of accessing raw data inside disk images; but I had not figured out how to get it work against a host itself.
I opened 7-Zip (as Admin) on my machine and poked around a bit; turns out that the places that can be valuable for analysis are few and far between. They’ve pretty much been documented in this RegRipper plugin .