1

I have found the following in a trojan sample. First, it gets the token of the current process and then it calls the GetTokenInformation() API with TokenGroups as InfoClass parameter. So, it puts the TOKEN_GROUPS structure to a certain place. Later, it uses the AllocateAndInitializeSid() API with the following parameters:

      PUSH EAX
      PUSH EBX
      PUSH EBX
      PUSH EBX
      PUSH EBX
      PUSH EBX
      PUSH EBX
      PUSH 220
      PUSH 20
      PUSH 2
      LEA EAX, DWORD PTR DS:[EBP - C]
      PUSH EAX
      CALL DWORD PTR DS:[&ADVAPI32.AllocateAndInitializeSid]

So, is the SID string S-1-20-220 ? If not, how I can extract this?

Note: Some lines later, the trojan compares this SID with the SID values from the TOKEN_GROUPS structure using using the EqualSid() API. I mean, it accesses the 2nd field of TOKEN_GROUPS structure which is an array that consists of SID_AND_ATTRIBUTES structures. Each of these structures has a SID field which is compared with the initialized SID. For that reason, I would like to know how the initialized SID looks like.

best regards,

1 Answer 1

1

Based on the documentation for AllocateAndInitializeSid():

  PUSH EAX ; pSid
  PUSH EBX ; dwSubAuthority7
  PUSH EBX ; dwSubAuthority6
  PUSH EBX ; dwSubAuthority5
  PUSH EBX ; dwSubAuthority4
  PUSH EBX ; dwSubAuthority3
  PUSH EBX ; dwSubAuthority2
  PUSH 220 ; dwSubAuthority1
  PUSH 20  ; dwSubAuthority0
  PUSH 2   ; nSubAuthorityCount
  LEA EAX, DWORD PTR DS:[EBP - C]
  PUSH EAX ; pIdentifierAuthority
  CALL DWORD PTR DS:[&ADVAPI32.AllocateAndInitializeSid]

I'm guessing that EBX was set to 0, so this is effectively the following snippet from https://msdn.microsoft.com/en-us/library/windows/desktop/aa379620(v=vs.85).aspx:

Snippet

The SID for BUILTIN\Administrators is S-1-5-32-544.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.