Welcome back.
Now we are going to put the filters for the propman and he's had a few days ago, we are going to use
the same as before.
So let's get started.
So the first thing you need to filter out is the name of the application of the malware.
So click on the filters icon here and then select processed name and isolate the name of yourself.
And clear and clear by.
So now he has to decide who the next one we are going to shoot and by the API call, so we select and
hear operations and select the API and the filter.
So the first one is right file.
Click on air and click on the play, the next one is set dispositioned information file.
Click on.
Click on Apply.
And then the next one will be ready set value.
Right.
Set that you click on at.
Click on Apply.
Next one will be processed, create.
So click on Search for Process Create.
Process, create, click on and click on apply, and the next one will be TCP and UDP.
So just key TCP so that you can search for anything related to CB.
Click can apply.
And last one is you'd be free to apply and click.
OK.
He says, finished playing future.
OK, and now we can see these are some indicators of compromise, he he has called the the FBI to create
to drop a new fire expanded in his path, and he uses the FBI to create a new registry key.
Car windows loader, and he calls the right fire API to create a new file in this location, and he
also set the registry value.
And you really see value conversion probably to keep track of the version of this.
And he also created that persistance key here in USA in this location.
So, OK, so now we can export this.
So we click on options.
Before we had this set of chain silicones, we show you this and this, this and this to make sure to
I.D. check, OK?
And I'll be saving two for me, for so many Sapna for me.
So like all events and it'll be in for format and here choose the path to the desktop.
Hey you put your malaby.
So for I guess to.
I saw the two in theory, here is the OK, and the second question is yes, Vihar for me not to use
so farse whole event and here you see ASV.
Khama said political values and your location is fine.
The same location, Decky.
OK, now we can open that and analyze it from the so called the fly to utilities and select look for
that.
And right.
OK, and he should set the OK, clearly Tudorza, he opened fire in your desktop location where he saved
open and click on this to launch the analysis, his head start to give us some time.
Now the analysis is complete and click on the name itself over here and then click on refresh and regenerate
the visualization to show you its analysis.
So now the visualization is done, we can zoom in.
Hold on, control key and scroll wheel material and you can see so the mobile name is Financials on
Unpacked and you created a threat and it's created a file called.
And then here you can see it has also created a registry, keko windows of their loader, and it is
orthostatic.
I mean, this is a persistance mechanism.
And what he's going to do to also start, you can see an arrow coming from here has value.
So when the user restarts the computer or relaxin, he will automatically run these expanded.
And now the question remains, is this expiry date the same file as EIC?
Is it in fact or not?
How are you going to know?
Right.
So because here we didn't see anything.
Kalinin, just like the first one.
We clearly saw that the malware rename itself after copying itself by here this morning in.
So, you know, the final expanded is as far as financier's unbaked.
We can use hash.
Right.
And use hash so we can go and do that.
Now we can create a hash for the first file in compatibly.
So we go to the location of the malware.
We click on this one on a hash, my fault.
Now we got modify, we copied, modify and put it in
an original.
Now we go to the location, the location of the victims here, see Windows XP and create a hedge for
that as well.
So we go to see dry.
And you go to windows and look for this beautiful.
And right, click it and select hedge funds and then to Copiah, the MD five as well from here.
Copy and define and put it in your notebook for comparison.
And you can see the identical exactly the same.
So this confirms that, yes, he is exactly the same father as his original name.
Right.
The other thing he does is he also create a new trick.
You can see from here through a trick to it to fall and increase and fall in this location and literally
and his new fall, he's got install that and then the trouser also creates another key, this registry
to keep track of his version.
And interestingly, he also, Chris, and other persistance mechanism here and this time the Keys,
Qualcomm and this is going to run is always funny because obviously he did not it the arena long enough.
So audio file is still there.
So he's going to run to two copies of itself.
One is here and the other one is here.
So we seeing quite a number of things here in this analysis indicate this of compromise.
So in the next lesson, I'm going to do the Neville analysis.
Thank you for watching.
I'll see you in the next one.