Welcome back.
We continue after that analysis by sample one, so we stop here after getting the all the the process
monitor and also the output.
So now we want to filter out the process monitor.
We filtering.
We can see about two hundred and twenty one thousand events.
So we are going to shoot out a few things.
So click on the filter here.
And then the first thing is we select process, name, process name.
Noufal process name.
Because these events are events for all the events of the entire operating system, but we're only interested
in our Malvasia claim process and down here, this Andromedan list and click on this now
and you can see added to the filter when you click apply.
Watch what happens down here.
All right.
If he does reduce the number to eight thousand, OK, so now we are going to continue adding additional
filters.
And remember, this diagram is going to add.
So next one, this operation is so we click on here.
Select Operation is approaching.
This is the API API calls.
So the first operation for CBS right file.
The filippa.
And they had to apply.
And he is reduced to 66 and now next on, he set position information file.
Set.
Disposition.
Certain disposition information file is to too fast, so clear, clear by OK, now this one is set to
value.
Rick, such value add and apply, and it makes for an easy process create.
So much for process create.
If any, Malgorzata appears to be doing.
You can apply and apply and then Tsipi.
There's no need to search because there are many MCPS, so you're using the menu Tarkin to select all
the tips and apply.
And then you come to this UDP networking protocols, all right.
So now we can close this and then we need to study options, make sure none of this checked.
They select select columns here and here.
Be sure to check and the rest are as follows.
Follow exactly what you see here for my setting and then click, OK, now we're going to save you twice.
One is in it for Mackley, Farsi and in all events need format DMM and then click on this to select
the location to save his capture.
Select the sample folder here and see.
So this is P.M. Piranesi KCK.
All right.
The reason why we say FEMA is in case later on you want to reopen it, to re-examine, you can you can
do it this way, then the second format you're going to save is to it.
It all events here.
Alexia's this version is for the next program, which we are going to use to visualize the event.
That is probably not so, probably quite as GSV.
So here are the locations seem blocked by the name is different extension.
OK.
So just wait for it safe now.
He's done.
We can now bring our product.
So, yes, go to the flying the utilities and open the problem, that program.
Yeah, OK, so basically, OK, here and here, make sure you set the path to the ECD, this, they're
being done.
This is not necessary, but this definitely we need.
So I've already shown you how to install gruff voice in one of the earlier video.
So if you have not done this step, go into it now.
Select above, which is part B, OK, and then this.
If you are going to open the CSP file by clicking these three dots here and then go to the desktop where
you see the log file format, prop 162 open and then now you can click on this to launch this street
as click on lunch and he will start analysing the CISPA so that analyze.
Once it once it is finished, the analysis, you will see a list of all the processes, just click on
the Malvasia and double click on it to select it, and then you need to refresh the screen, refresh,
and now you regenerate the analysis graph for you to visualize.
And he has generated the graph and compare this with your propman from one has two hundred forty three
events and he is quite good in itself, but it is too many to try to comprehend what is going on.
So Braungart takes all of these events and find the relationships between them and visualize it in a
graph which is so much easier to understand.
So if you want the raw output, you will look at one events here from here.
You can see he's writing to this far, creating some registry value here.
Creating a process here is on by way.
This is good for you.
Get us a compromise.
But the reason I didn't understand he used this.
So this is the interactive graph.
You can actually hold down the control key and zoom by scrolling your wheel off your mouse, zooming
in in the and you can try and move around.
And here is a budget.
And the old you know, Malvasia, he has created a trick is you're going to see to do it for.
And then over here, he has created a process seeing the process here.
And then over here you can see in the back here, he also created a temporary batch file, one to fold
on that.
And then this file was executed in order to delete something else.
So you can see he probably used a batch file to create another trick and process to kill the file and
which was used to delay it by Schwyzer and then over here.
So we also created persistance key in this location, in this registry, you just Newquay one two six
four four three zero.
And this is how it started.
So when the computer reboot itself and then what is actually going is going to restart this fast one,
you can see the arrow coming from here.
So it is persistance.
He is going to run this far and then this far if you trace it.
He has been actually running from these.
Sajani, see the.
Her name is Project Report, and then we see the Dutch label here renamed to a different name so that
we now know Sedgman and Budget Report are the same.
So this is how he hides, how he hides itself in this location.
And then from here, Iranian mizu and in the.
And he has created some of the cases where.
So those are the main indicators of compromise.
See you see here.
So if he had not used product, we would not be able to see this kind of relationship between the various
components of these components are known as artifacts Hemery analysis.
So artifacts are the leftover glue.
So evidence then malware has existed or did something.
So this collection of all these artifacts here will become your indicators of compromise.
So.
Those are the important, how important and how useful this product to when used in conjunction with
Propman.
So now if you wanted to write a report, you will probably write a report to be sure all these things
listed on this file.
He has been renamed from a previous pholcodine and then he has created a registry entry here and it
has also created a batch file used to give itself later on and later on the file patch files also remove
him and all the registry locations, as well as to the location of the new far right.
This will all be included in your report for the indicator of compromise.
Now, the next thing we do is no analysis.
So for now, analysis.
I will see you in the next video.
Thank you for watching.