(Aaron) Got it.
Getting into this, can we detonate it?
Let's do it.
(Tyler) So I've got a number of tools here that we've talked about in our
previous Play by Plays about when we set up the sandbox.
But we're going to run three different tools.
On the right-hand side here I have Process Explorer,
and again we're just using Process Explorer to kind of
watch to see what the malware does.
It's more of a visual indicator for us.
But then we have two other tools,
which are going to be used to monitor its behavior.
Now the first is Regshot, and I'm going to go ahead and launch Regshot.
Regshot, again, takes snapshots at points in time and then compares the two.
So I'm going to tell it to take its first snapshot,
and this'll take a couple seconds to maybe a minute or so,
really depending upon how busy your system is,
the resources, and so on.
(Aaron) Right, we also talked about,
when you've ran it on Windows 10 you've been having
problems recently with the current version.
(Tyler) Yeah, Regshot can kind of lock up every once in a while,
and it seems to do that on some of the later versions of Windows 10.
But on Windows 7, for the most part, it seems to be okay.
(Aaron) So that's good to know in case you run into that.
(Tyler) Right.
So, I'm just going to minimize that, and then we've got Process Monitor here.
What I'm going to do is I'm going to click on the little magnifying
glass up here and it's going to start capturing data.
So that's going.
You can see down, it's already captured a little bit.
I have a bunch of filters in place to kind of ignore
some of the normal system traffic.
(Aaron) Excellent.
(Tyler) So then I'm going to minimize this, and now we're going to run TrickBot.
Now the thing to watch is, I'm going to kind of pull Process Explorer over here,
watch Process Explorer because as soon as we launch it,
it's going to start doing things.
And while Process Monitor is recording stuff,
Regshot will be able to do our comparison,
this will at least give us an idea of what it's doing.
So I'm going to launch it.
So there it kind of started up,
and you can see that the CPU is kind of spiking for that process,
or it was, and so it's definitely doing something.
(Aaron) And it's not normally,
in a normal infection it's not going to be called TrickBot.
That'd be too easy.
(Tyler) No.
It's going to be called something that kind of looks
benign or something like that.
But TrickBot is kind of doing its thing.
Probably in the background it's already set up some of its persistence.
And what we'll see here in probably about a minute or
two is that TrickBot is going to,
a second version of TrickBot is going to get launched,
and then this TrickBot will go away.
And it's here you see that TrickBot started back up.
The other one shut back down.
So now it kind of got, you know, changed around a little bit.
It's probably running from a different place.
And you can even see in the description and the company name of
TrickBot that's on there are kind of these random words,
and malware authors will put that in there to kind of make it look real.
(Aaron) Yeah, so when I booted that up in _____,
I saw the company name there, the Y1000 LogiGear,
and I saw the description.
I also saw a version number.
It was like 3.3 .4 or something like that.
(Tyler) Yeah, that's probably just some random one.
Just some random version number.
(Aaron) I thought that'd be too nice of them to put the software to
finalize the whole version number in there for us.
(Tyler) So, what ended up happening, if you're watching,
TrickBot kind of launched svchost.exe, and svchost is a normal Windows program,
and then it kind of killed that.
If we wait a little bit longer,
we're going to see svchost kind of start up again,
and that's kind of the main malware process at that point.
What's going on here is that TrickBot is using a
technique called process hollowing,
and essentially what that is is TrickBot will start up
a legitimate program like svchost, which is a normal Windows program,
but it'll start it up in what's called suspended mode.
In other words, it loads everything into memory,
but then it doesn't allow it to execute.
And once all that legitimate program gets loaded up into memory,
it then copies all of the malicious code into that process in memory.
It kind of hollows it out and throws in the malicious
code and then tells the process, okay, now you can start executing.
(Aaron) Because that memory location has been deemed
allowed to execute within the Windows OS,
right?
And so if you then place the executable code in there,
it'll run under that context?
(Tyler) Exactly.
And, so we can see that svchost has started running again.
Not only that, all of our tools, just looking at the process list,
you see svchost running here.
You don't see TrickBot.
So even though this host, I can guarantee you this host,
or this process is a malicious process in memory,
if I were just coming there and just using,
like Task Manager to see what's there, I would see svchost.
Additionally,
one of the things that we can do really fast is we can do
something called Verify Image Signatures.
So what this means is Process Explorer is going to go through and it's going
to verify all the code signatures on all the processes.
Watch what happens when we do that.
This svchost that we know is malicious is verified as Microsoft.
And the reason that is is because you can't do,
you can't verify a code signature of something in memory,
because as soon as it gets put into memory,
it changes all over the place.
So, tools like Process Explorer,
when they verify code signatures they have to go back to the file on disk.
And just by looking at this process, it's pointing back to svchost,
svchost it verifies.