Welcome back.
In this video, I will show you the correct way to do that analysis.
There is a correct sequence for you to follow dynamic analysis, workflow.
Follow the sequence exactly, number one, start Brockmann.
Then pass and in the output.
But once you get past.
Then Amadu Cygnet, Freenet immediately start to monitor the Internet traffic and intercept any attempt
by the malware to connect to the.
To the Internet and then we'll respond with a response to the email that.
And the tree strikes shut.
And then take the first shot, click on the button for sure, and the reason why we post Propman because
we don't want to capture the changes made by rection.
Otherwise, we have far too many events for you to look at and to filter.
Then the move to wait for the right to do his thing may take a few minutes.
Of course, you must have the correct settings there should be taking a snapshot of this see dry the
root of the system itself.
So and for once, the first shot is complete.
Then he will pass by, so do not click the text button yet.
Instead, he won't do now resume Prop one, which was earlier passed.
The reason why we're using problem, because in the next step, we are going to execute a malware.
So we want people to monitor the.
Now, that process itself and I rang the Bell Bay and let it run for one to three minutes, and then
why this running study finished output to see what the I was trying to do in terms of network connectivity.
Remember me trying to call home and contact the controller and command center or reach out to a server,
download additional bailouts or additional to.
After about three minutes bossom propman, so propman by this time would have captured enough events
for you to analyze later.
Now, number seven, we use Rashon.
Go back to you.
Now you click the button, second shot.
So now we take the second shot and see what a genius there has to be me.
The reason why we use is to compare the changes made by the mouthy.
And.
The second should be fairly fast compared to the first shot, so once the second shot, complete picture,
compare button and compare and put.
So now compare the first shot and the second shot to see what changes there has to be made after the
mother has started running.
So once the combat operation has completed, this also should take about one, maybe two minutes.
And when I study the reaction, I would go through it and see what are the changes that has to be made
to the operating system, for example, new keys in the registry has been created.
A whole new force has been added, new food created and so on.
Now, next time you are going to look at Brockman's events there has been captured.
So in order to look at the events, we need to find out and look only at process, which you are interested
in, which is Homel by itself.
So to do that, we need to apply some filters so our filters, when you apply them, number one person's
name.
So this is what it looks like when you apply the filters over here so you can select itself further
from them.
But from the dropdown this year and then after they select the name of the of the operation or the name
of the processing here.
So the first thing is we select processed name and then from the dropdown this over here, select the
name of the Nabay.
So that will and then click and then you will see the first you tell me edit.
And then after that.
Second, if you apply and the operation is through the means from here, you select from a journalistic
operation is.
And here, hear this one at a time and get to the brutalist.
So the first one is right for this position, information for this one is used for deleting files.
Now, that typically deletes itself after he has made a copy and hide it somewhere and then Rexach value
his registry, Muki negated the process is Israeli military, new processes, new dress, DCB and Goodbody
networking protocols.
So all these are the things we are interested in to filter from the long list of the events that Propman
has captured.
So once you added all these to your lists should be shorter.
You may start off five hundred and eight thousand events, but how they apply to filter it will be put
out to show and maybe less than 10 embittering events.
So this is manageable.
And as you can see, after you apply the filters, you can see clearly these are only the values.
There has been filter for the various API calls.
Right.
So just looking at this one, you can see some of the indicators are compromised.
But we want to go a step further.
We want to visualize this in a graph view using analytical product.
Before you can visualize it in your product, you have to configure your process, monitor.
And export the necessary force for productive use, so to do that, and we want to set the settings
accordingly for it and the settings I we show you in particular.
So as we do it and I believe you also seeing the video in your previous videos, you listen to where
you need to configure and process monitor accordingly to use the options to show the correct and correct
column.
The color must be shown.
And also, southern colonies need to be hidden.
So if you've forgotten how to let peace Glenn review the agenda, you really start graffiti's in that
video I showed you how to configure, process, monitor for exploiting the current format for product.
Next thing I want to mention is these are some of the.
Coming from Conchita's, so you can see if you are going to do the one.
These are some of it.
In just one year, Indonesia shows and is the one in both some of the important ones.
Right.
File separation so far.
Registry Sangrail, potentially DCB and UDP.
You can also experiment with the others by adding them if you want.
And then I also want to hear from you about the registry persistance, these are some of the registry
keys locations which can allow the mother to survive a reboot of the operating system.
So if a mother tries to put anything in these locations by creating new guys, then it's a sign of a
compromise, an indicator of compromise.
So we have to deal if the EU, FTC, so.
Look out for these new Keatings race relations.
And I to be aware, is the differences between the two big programs and 60-40 programs and how it runs
on windows, if you're running an operating system, which is 64 bit and your program and you're running
is 64 bit, then the fast he'll be coming from in the system to present poor country to the air will
be coming from here.
So the 64 bit of program or malware will be using those the same system daily to.
On the other hand, if you are running a little bit program on the 64 bit operating system, then they'll
still be coming from this for the Windows system, all 64.
So this is to make it backwards compatible.
That's why try to be programmed ethically, 64 bit windows.
Next thing you should beware of EDL, such honor when a program runs, it will need to use a net exporter
from the elephants.
So the fans are typically following even those who are in the system or in the system daily, too.
And sometimes whenever we try to bring them by putting its own version of the that exactly the same
as the system.
So we can do that by putting it in a directory in its own directory.
So this is the Great Recession or anything that is found in the directory on the left who will be run
first before the directory on the right.
So if a program is going to run, it is the order in which he was search for a job.
So now let me put it on the air, same directory which is running.
So he will run that thing on the air instead of the one found in the windows.
System for them to be around that, so you find they're inside their mouths for days.
And he has the same name as a window system for that.
Yeah.
And then, you know, Tandia is facing the corruption of the.
So that's all I want to inform you about, the prerequisite knowledge that you need to have before we
start to do the practicals on the dynamic analysis.
So thank you for watching.
I'll see you in the next on.