Hello and welcome back.
We are now going to start dynamic analysis using the same dynamic analysis workflow which we have used
before, and we are going to do it on financials_unpacked.
So the first thing we do is start up the Procmon.
So down here, click on the Procmon program, and then
we are going to pause it, and then we are going to clear the output.
Next thing we are going to start FakeNet.
So click on FakeNet down here and let it run.
FakeNet will intercept all the network traffic which the malware is generating.
Next, we are going to do the Regshot.
So just click Allow Access.
And now we open the Regshot tool from utilities.
And then here, click on the checkbox and change the directory to C:, drive the root of the file system,
and click on 1st Shot.
Click on Shot, and this will take a few minutes.
So I will pause the video and come back when it is done.
Now it has finished the first shot.
You can see the message popping up here.
We can click OK.
And before we take the second shot, we need to run the malware itself.
And we know that the malware itself needs to run with elevated privilege, because we saw
from the earlier static analysis it is trying to drop a file in the Windows location, which is
a protected folder.
So we need to run it as administrator so that it can do its thing.
So we go back to the malware and run the application as administrator.
But before we do that, we need to start the Process Monitor.
So we click on Capture on Process Monitor, and then we go to the malware itself, right-click,
and then we run as administrator.
Click
Yes.
And immediately you see this fake message popping up.
"Your PC is infected.
Windows has detected spyware infection.
It is recommended to use special anti-spyware tools to prevent data loss," and so on.
And it wants you to download something.
And we saw this message when we were doing the static analysis earlier.
And also in FakeNet, you will see that some activity is going on,
and over here you will see
it's trying to connect to the Internet and download something from the Internet from this website,
downloadantivirus3.com.
So this is the server it's trying to connect to to download additional packages.
So we'll just let it run for about maybe a minute and then keep an eye on this FakeNet to see if there's
any additional activity going out to the network.
And you can see now the Process Monitor is capturing the events.
Up to 33,000 out of 87,000 events have been captured.
Later on, we will analyze the output and will see whether or not it drops this file in this location,
as indicated by our static analysis.
So far, FakeNet is not showing any additional activity on the network.
Okay.
I think we can stop this Process Monitor now, so we can stop it by clicking this icon here.
And after we stop the Process Monitor, we are going to go back to Regshot and take our second shot.
So head back to Regshot, and now click on 2nd Shot, and then select Shot.
And this should be relatively faster than the first shot.
And the second shot is now complete.
As you can see, the message has popped up, and we can click OK on that.
Now we are going to click on the Compare button and select Compare and Output.
And this will take a little bit longer than the second shot.
So I'm going to pause the video and come back here when it has done the comparison.
The comparison is completed, and now it has popped up this text.
And let's start analyzing.
And from here we see that there are certain values added,
and over here we see this one.
A new key has been created
in this registry, and the key name is called Windows Update Loader,
and the value is this path to this file.
So sure enough, this is the persistence mechanism for this malware.
So it is going to run this new file which it has dropped into this location, C:\Windows, and the file is xpupdate.
So whenever somebody reboots the computer or logs off and re-logs in, it is going to run this dropped
file here.
And surprisingly, there is a second persistence mechanism here.
It has also created a new key called con in the same location as the first key, our first registry
location,
and this time it is calling itself.
So we have two persistence mechanisms.
Okay, now let's scroll down and see if there's anything else.
Nothing suspicious or interesting here.
And the files added,
you can see that it has created two files, has dropped two files.
One is install.dat in this location, Users\PC\AppData\Roaming.
So we can copy this out and put it in our Notepad as additional notes.
And then the second one is xpupdate, which we already noted when we did the static analysis earlier and
saw the same thing as well above.
So these are two new files being added.
Let's scroll down.
So those are the indicators of compromise which Regshot has revealed.
So now let us move on to Procmon, and we are going to prepare Procmon
okay for export.
But before that, we need to apply some filters because at the moment we have 89,000 hits.
All right.
So to do the filters, we will continue in the next video.
Thank you for watching.