Hello, in this video, we are going to do the political dynamic analysis formalwear one.
But first, some precautions, make sure you are using your Twitter machine.
And then as additional precaution, you can go down to the bottom and disable the network, so go down
to machine and click on settings.
And then over here, you know, you could actually do this, go down here and set the house on that
so they would disable the network.
But this is optional, right?
I'm going and I'm going to do it because I'm not connecting to my local area network inside my office
or anything like that.
So it's quite safe.
So in your case, you've got to take these extra precautions if necessary.
So, no, the first thing is you are going to follow the sequence here a month and then.
So go to one and a bottom here, click on from one.
Again, once you started this, Bozie.
This is a button click on this to Pozzi and click on these to clear the output.
Second start.
So finally said a bottom here, so just click this icon to study.
And they will fire and the set all the naval traffic that never will.
Jan.
Next, we are going to start, Reshat.
So just be honest, I license.
So for a shot of on the flag, for the utilities, for the inside, look for a shot and started.
And now here on this, Jambox, both here and in Chechnya, dietary change to see, like Senesh, you
want to snap, snap shot the entire root system so clean for shot.
Click on.
And he is now creating a snapshot of your entire VA system for the washing machine, and this will take
a few minutes, so I'll just pass the video and come back when it's done.
The first snapshot is not done, and I get this message informing me is OK, but I don't take the second
shot anyway.
Now you're going to start our propman.
So we're going to resume propman, so come over here and capture.
So no one has started and now we are going to execute the nailbiter, so we are going in and execute
MLV.
And immediately, you see the mother has disappeared and media has deleted itself.
And if you look at it, you can see that it has reached up to the Internet and posted something to this
website and B, Q, A, Y, A, C and B, and then is also posting.
To this pop up in the U.S. on and he just connecting to a so I can see, you know, whose name and the
number.
So it is a vegetable and it is posting some data and the latest entry advice.
And this is the the key that you pay.
It is posting a value A and this is some kind of encoding.
From here to here.
So now we are going to let it run for approximately one to three minutes and see if anything else in
Quicknet.
So they met in Sydney, and you can see here it is now sending another post.
So if that has intercepted all the Internet traffic that malware has generated and showing here and
the second poster is also sending us a picture, you can see the Yahel hostess's the same and the same
and the base is also the same 930 advice the same.
And I think the the encoding here, the data that is being sent is also the same.
So it is trying to send the same data, posting it to the same server.
And he has done it twice so far.
So we just give it another one minute roughly, and then we'll deal with the boss on.
All right, so now he has sent another post, as you can see here, and it appears the length also 930
advice and hostess's in the queue, so on.
So Bluestar is trying very hard to to post this data to this Web server and in has intercepted it and
reply back to the malware.
But probably the malware did not recognise the reply.
That's why he continues to try to send the same same data to the server on the Internet.
So that's why we're seeing three posts here, identical posts.
So that's how big that Rufina intercept traffic and pretends to be a server, but it does not forward
the traffic out to the intended server.
That will reply with his own message and getting something back to the malware.
And this is a post you can see.
So he has posted four times identical packets, one, two, three, four.
So now from here, we can see the indicator compromised.
The hostname is in plain sight for for to see over here.
All right.
So now I think we can pass the precise monitor.
So let's pause it.
And then now you can go and use a shot to take our second snapshot and see what changes.
Second shot in English shot, so the second shot should be faster than the first shot.
Oh.
Once he has completed the second shot, the compare button will be clickable so that it can do his job.
I'll post a video and come back when he's done well.
Looks like it's done so kayna.
All right.
So now we can do a compay.
Just click on this button here, compare and scroll down to compare output so that once he's finished
comparing the first shot in a second shot, he will immediately display the output.
So click on this and they do his thing.
So this will take longer than a second shot.
So I'm going to pass the video and come back when it's done.
The comparison is done and this thing automatically pops up.
So now we can analyze this and see what happened so we can see here values edit and oh, here we can
see a new key has been created.
This is a key one two six four eight four three zero and is the value of the key is greater in this
registry.
Esman five to one is the user, which is the navigator, and this is a software registry and then run
one.
So this is a persistence here.
So he's trying to create a method for it to persist.
So he create a new key, this key.
And here we have the actual file, which will run when the when the malware starts in the next reboot.
So you can see it is you just put a new file created and you focus month on the AC in this location.
So now you can know when he never has hidden a copy, maybe a copy of itself with a different finding
at this obscure place.
In this coda.
So we are seeing two indicators of compromise from this far.
And let's take a look and see if there's anything else.
OK, photostated, yes, great ideas for the.
In order to put the CDF on following day, so it is 30 seconds, they could have compromised, same
as a settlement facility.
So he has deleted his student.
And we saw with our own eyes that when we started running the first time
fast edit this is the one.
So he's created this new file and put it in this location and it's just to make sure that he can run.
He also created a registry entry which saw.
So we found a lot of riveting things from this Raksha.
So now the next thing we do is to do the propman filter.
So let's go to prom on.
OK, here.
OK, for the Monforton, I will continue in the next video, so stay tuned, I'll see you in the next
few.