Intel® RPIER 3.1 User Training Joe Schwendt Steve Mancini 7/31/2006

What is RPIER Rapid Assessment & Potential Incident Examination Report Designed to acquire commonly requested information and samples during an information security event, incident, or investigation

How is RPIER used Run on suspect machines in unaltered state Collects potential malware samples loaded into memory Enumerates recent system changes Reports basic system configuration Exposes possible backdoors Enables some recreation of events Scans for known malware

RPIER System Requirements Windows NT based Operating System Support x86, EM64T or IPF architectures Must run from writable disk Results Directory must be able to accommodate the size of physical RAM x 1.5. Thus, if a machine has 2 GB of RAM, the Results directory must have 3 GB of free space (Only required for some modules)

RPIERs GUI Module Selection Area Modules can be selected individually Time to run and size of results for each module varies from machine to machine

RPIERs GUI Quick Select Scans Fast Scan should run in approximately 10 minutes Slow Scan can take up to 2 hours

RPIERs GUI Online Indicator Tests connection to RPIER server Server used for Version checking and Results Uploading

RPIERs GUI Description field Allows clear identification of reason for RPIER Run Included in notification and RPIER.log within the results

RPIERs GUI Run RPIER Runs Forensic pre- check (optional) Executes all selected modules Auto-ZIPs results (optional) Auto-uploads results (optional and requires online connection to server) Runs Forensic post- check (optional)

RPIERs GUI Help Contents Displays the RPIER Online Help file

RPIERs GUI Update Version Checks to see if the local copy of RPIER requires updating Prompts for updating if required

RPIERs GUI About Displays the About screen with version information

RPIERs GUI Run Performs same function as the Run RPIER Button

RPIERs GUI Open Results Directory Opens the results directory via Windows Explorer

RPIERs GUI Upload Results Allows for uploading results ZIP file at a later time Enabled only when Online Useful for uploading results after having been Offline

RPIERs GUI Quick Select Scans Clear All Selections Fast Scan should run in approximately 10 minutes Slow Scan can take up to 2 hours All Scan can take over 3 hours and should only be enabled on special request

RPIERs GUI Options Displays the Options Screen

RPIERs GUI Module Directory The top level directory to find modules Should not need to be changed save for a custom developed module set Defaults to the Modules directory where the RPIER.exe is located

RPIERs GUI Results Directory The top level directory to output results to Must be writeable Defaults to the Results directory where the RPIER.exe is located

RPIERs GUI Auto-Zip Results Results directory is compressed using standard ZIP compression Enabled by default Typically reduces results by a factor of 10 (150 MB of results becomes a 15 MB ZIP file)

RPIERs GUI Auto-Upload Results Results ZIP file is uploaded to the central RPIER results repository Only enable-able if Auto-Zip is enabled Only enable-able if Online If Online, enabled by default

RPIERs GUI Zip Filename Name of the ZIP file that will be generated

RPIERs GUI Upload URL URL to upload the results to This URL needs to be writable but not readable

RPIERs GUI Process Priority Allows RPIER to run with higher or lower than normal process affinity settings Facilitates running with low priority when launched silently down the wire

RPIERs GUI Forensic Integrity Check Enables a pre and post snapshot of the registry Enables post run of MACMatch over the time it took to execute all of the modules Adds ~10 minutes to the execution time

Installing RPIER RPIER is distributed as a ZIP file via Unzip onto writable media of choice (USB Flash Drive, USB/Firewire External Hard Drive, Internal Hard Drive, etc.) Run RPIER.exe If online, RPIER will automatically check to ensure it is the latest version. The application features the ability to update itself from a secure source (SHA1 and MD5 checksum verified) Note: RPIER does not extend its footprint beyond the directory it is launched from unless otherwise specified in the options screen

Running RPIER Select the appropriate modules for the malware suspected Click Run RPIER button If Online when running RPIER, the results should be automatically uploaded at the end of running the selected modules If Offline when running RPIER, you will need to later run RPIER when online and upload the results ZIP file. NOTE: RPIER is designed to collect volatile state information from the target system. Do not disconnect, shutdown, or alter the system state until after running RPIER unless directed to do so. This may alter the effectiveness of collecting malware samples.