# Windows API Monitoring Reference

## Overview

Monitoring Windows API calls during malware execution reveals the sample's capabilities and intent. This reference groups key APIs by behavioral category for focused monitoring.

## Process Operations

### Process Creation & Injection

| API | Significance |
|-----|-------------|
| `CreateProcessA/W` | Creates a new process - watch for suspicious child processes |
| `CreateProcessInternalW` | Low-level process creation, may bypass monitoring |
| `NtCreateProcess` | Native API process creation |
| `ShellExecuteA/W` | Execute files, open URLs - common for droppers |
| `WinExec` | Legacy process execution |
| `OpenProcess` | Opens handle to another process - prerequisite for injection |
| `VirtualAllocEx` | Allocate memory in remote process (injection step 1) |
| `WriteProcessMemory` | Write to remote process memory (injection step 2) |
| `CreateRemoteThread` | Create thread in remote process (injection step 3) |
| `NtCreateThreadEx` | Native API thread creation in remote process |
| `QueueUserAPC` | APC injection technique |
| `NtQueueApcThread` | Native APC injection |
| `RtlCreateUserThread` | Undocumented thread creation |
| `NtUnmapViewOfSection` | Process hollowing - unmap original image |
| `NtMapViewOfSection` | Map new image into hollowed process |
| `SetThreadContext` | Modify thread registers - used in hollowing |

### Code Execution

| API | Significance |
|-----|-------------|
| `LoadLibraryA/W` | Load DLL - watch for unusual DLLs |
| `LdrLoadDll` | Native DLL loading |
| `GetProcAddress` | Resolve API by name - dynamic import resolution |
| `LdrGetProcedureAddress` | Native API resolution |

## File System Operations

### File Manipulation

| API | Significance |
|-----|-------------|
| `CreateFileA/W` | Create or open files - watch paths and access modes |
| `NtCreateFile` | Native file creation |
| `WriteFile` | Write data to file - payload drops, config writes |
| `ReadFile` | Read file contents - data theft, config reading |
| `DeleteFileA/W` | Delete files - self-deletion, anti-forensics |
| `MoveFileA/W` | Move/rename files |
| `CopyFileA/W` | Copy files - self-propagation |
| `SetFileAttributesA/W` | Hide files (FILE_ATTRIBUTE_HIDDEN) |
| `GetTempPathA/W` | Get temp directory - common drop location |
| `GetTempFileNameA/W` | Create temp filename |

### Directory Operations

| API | Significance |
|-----|-------------|
| `CreateDirectoryA/W` | Create directories for payload staging |
| `FindFirstFileA/W` | Directory enumeration - reconnaissance |
| `FindNextFileA/W` | Continue directory enumeration |
| `GetCurrentDirectoryA/W` | Environment awareness |

## Registry Operations

| API | Significance |
|-----|-------------|
| `RegOpenKeyExA/W` | Open registry key |
| `RegCreateKeyExA/W` | Create registry key - persistence, configuration |
| `RegSetValueExA/W` | Set registry value - persistence, config storage |
| `RegDeleteKeyA/W` | Delete registry key - anti-forensics |
| `RegDeleteValueA/W` | Delete registry value |
| `RegQueryValueExA/W` | Read registry value - environment checks |
| `RegEnumKeyExA/W` | Enumerate subkeys - reconnaissance |
| `NtOpenKey` | Native registry key open |
| `NtSetValueKey` | Native registry value set |

### Key Persistence Locations

Monitor writes to these registry paths:

- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
- `HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce`
- `HKLM\Software\Microsoft\Windows\CurrentVersion\Run`
- `HKLM\SYSTEM\CurrentControlSet\Services`
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`
- `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options`
- `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders`

## Network Operations

### Socket & Connection

| API | Significance |
|-----|-------------|
| `socket` | Create network socket |
| `connect` | Establish outbound connection - C2, exfiltration |
| `send` / `sendto` | Send data over network |
| `recv` / `recvfrom` | Receive data from network |
| `bind` | Bind to local port - backdoor listener |
| `listen` | Listen for connections - backdoor |
| `accept` | Accept incoming connection |
| `closesocket` | Close network socket |
| `WSAStartup` | Initialize Winsock - indicates network capability |

### DNS & HTTP

| API | Significance |
|-----|-------------|
| `gethostbyname` | DNS resolution - identify C2 domains |
| `getaddrinfo` | Modern DNS resolution |
| `DnsQuery_A/W` | Direct DNS query |
| `InternetOpenA/W` | Initialize WinINet - HTTP communication |
| `InternetConnectA/W` | Connect to HTTP/FTP server |
| `HttpOpenRequestA/W` | Create HTTP request |
| `HttpSendRequestA/W` | Send HTTP request - C2 communication |
| `InternetReadFile` | Read HTTP response |
| `URLDownloadToFileA/W` | Download file from URL - payload staging |
| `WinHttpOpen` | Initialize WinHTTP |
| `WinHttpConnect` | WinHTTP connection |
| `WinHttpSendRequest` | WinHTTP request |

## Cryptography

| API | Significance |
|-----|-------------|
| `CryptAcquireContextA/W` | Initialize crypto provider |
| `CryptEncrypt` | Encrypt data - ransomware, C2 encryption |
| `CryptDecrypt` | Decrypt data - payload decryption |
| `CryptGenKey` | Generate crypto key |
| `CryptDeriveKey` | Derive key from password |
| `CryptImportKey` | Import crypto key |
| `CryptExportKey` | Export crypto key |
| `CryptHashData` | Hash data |
| `BCryptEncrypt` | Modern crypto encryption (CNG) |
| `BCryptDecrypt` | Modern crypto decryption (CNG) |
| `BCryptGenerateSymmetricKey` | CNG key generation |

## Anti-Analysis & Evasion

### Sandbox/VM Detection

| API | Significance |
|-----|-------------|
| `IsDebuggerPresent` | Check for attached debugger |
| `CheckRemoteDebuggerPresent` | Check for remote debugger |
| `NtQueryInformationProcess` | ProcessDebugPort, ProcessDebugObjectHandle checks |
| `GetTickCount` / `GetTickCount64` | Timing checks for acceleration detection |
| `QueryPerformanceCounter` | High-precision timing checks |
| `NtQuerySystemInformation` | System info for VM detection |
| `GetSystemInfo` | CPU count, architecture checks |
| `GlobalMemoryStatusEx` | Memory size check (VMs often have less) |
| `GetCursorPos` | Mouse position check (automated environments) |
| `GetForegroundWindow` | Window focus check |
| `EnumWindows` | Window enumeration for sandbox detection |
| `GetComputerNameA/W` | Hostname check for known sandbox names |
| `GetUserNameA/W` | Username check |

### Defense Evasion

| API | Significance |
|-----|-------------|
| `NtSetInformationThread` | Hide thread from debugger (ThreadHideFromDebugger) |
| `VirtualProtect` | Change memory protection - make code writable/executable |
| `NtProtectVirtualMemory` | Native memory protection change |
| `SetErrorMode` | Suppress error dialogs |
| `Sleep` / `SleepEx` | Delay execution to evade sandbox timeouts |
| `NtDelayExecution` | Native sleep |
| `SetWindowsHookExA/W` | Install hook - keylogger, input capture |

## Privilege Escalation

| API | Significance |
|-----|-------------|
| `AdjustTokenPrivileges` | Enable/modify privileges |
| `OpenProcessToken` | Access process token |
| `LookupPrivilegeValueA/W` | Look up privilege for escalation |
| `ImpersonateLoggedOnUser` | Impersonate another user |
| `DuplicateTokenEx` | Duplicate access token |
| `CreateProcessWithTokenW` | Create process with different token |

## Service Operations

| API | Significance |
|-----|-------------|
| `OpenSCManagerA/W` | Open service control manager |
| `CreateServiceA/W` | Create new service - persistence |
| `StartServiceA/W` | Start a service |
| `ControlService` | Control service (stop, pause) |
| `ChangeServiceConfigA/W` | Modify service configuration |
| `DeleteService` | Remove service |

## Monitoring Tools

### Procmon Filters

For targeted monitoring in Process Monitor, use these filters:

```
Operation is WriteFile then Include
Operation is RegSetValue then Include
Operation is TCP Connect then Include
Operation is Process Create then Include
Operation is Load Image then Include
```

### API Monitor Configuration

Focus monitoring on these API categories:
1. Process and Thread (creation, injection)
2. File System (create, write, delete)
3. Registry (set value, create key)
4. Network (connect, send, recv)
5. Cryptography (encrypt, decrypt)

### ETW Providers

For Event Tracing for Windows:
- `Microsoft-Windows-Kernel-Process` - Process events
- `Microsoft-Windows-Kernel-File` - File events
- `Microsoft-Windows-Kernel-Registry` - Registry events
- `Microsoft-Windows-Kernel-Network` - Network events
- `Microsoft-Antimalware-Scan-Interface` - AMSI events