We've let TrickBot run long enough, I think,
so we're going to start analyzing what it did.
So what I'm going to do is I'm going to stop my Process Monitor.
I'm not clearing the data, I'm just stopping what it did.
And then I am going to take my second snapshot, and then I'll compare the two.
Now, it's very important the order you do these in.
You don't want to take your snapshot first and then stop Process
Monitor because what's going to happen is Process Monitor is then
going to record everything that Regshot is doing,
and you're going to see the number of events that you record
jump up to hundreds and hundreds of thousands.
And it's just going to slow down your system.
You just don't need to do that.
Notice, too,
I'm letting TrickBot continue to run just so we can see what it does.
You know, maybe it'll start doing other things.
But I'm just going to let it run.
Normally probably what you would do is you would kill the process at this point.
But I'm going to click, my Regshot second shot is done.
I'm going to click Compare.
And then what it's doing is it's going through and it's
comparing the two snapshots that it took.
And just by comparing it,
we can see that there were a number of changes that
took place in the operating system.
And understand that Windows is constantly doing stuff,
so you're always going to have changes.
But what I like to do is first thing I'm going to do is
I'm going to jump down to Files added.
(Aaron) Yeah, that makes sense.
(Tyler) And if we look at that, we see a couple files that were added.
First, we see some file, webCachev01.tmp.
This is probably related to some web activity.
I'm not necessarily going to attribute that to TrickBot.
But the two files underneath that where we have files in my user directory,
AppData, Roaming, and then speedLan,
we see settings.ini and then this ttic so on .exe.
Those are definitely TrickBot.
TrickBot, when it drops itself, when it finally gets itself onto the system,
will move into the user's AppData\Roaming directory and it will create a
subdirectory under that with some word that looks legitimate.
(Aaron) So that's SpeedLan?
(Tyler) SpeedLan, yeah.
And you can actually often attribute the word there
that's being used to a specific campaign.
That seems to be hardcoded into different versions of TrickBot.
So it's not always going to be SpeedLan,
but if you find this directory on one of your systems on your network,
look for that directory everywhere because you may
have other SpeedLan directories.
(Aaron) That's going to be specific to the campaign.
(Tyler) Correct.
(Aaron) So you can't be like, oh well,
whoever got compromised and it says SpeedLan,
and I saw that on YouTube, so now I can use it on mine,
and that isn't necessary.
But there's no SpeedLan, so we're safe.
That's not necessarily true.
(Tyler) Exactly, exactly.
(Aaron) Because I've seen WinApp as well as another directory.
(Tyler) Right, exactly.
And then underneath it,
we see that there was a task created called Speed lan library.
Now, understand we, Regshot is not showing us what created these changes,
but we can kind of infer that, we know that the SpeedLan directory is TrickBot.
A task named Speed lan is probably going to be TrickBot,
but we're going to verify that.