(Aaron) Yeah, we can assume that, yeah.
Good to go verify.
(Tyler) So,
I'm going to jump over then to Process Monitor so we
can see exactly what TrickBot did.
So I'm just going to minimize Regshot here.
And the way that I'm going to do that is I'm going to use
Process Monitor's filtering capability.
So I'm going to first filter on process name,
and we'll only look at our original malware,
the TrickBot.exe.
So I'm going to add that filter.
And then, so if I do that and click Apply,
it still gives us 1300 events that we would have to look through.
I don't want to look through 1300 events individually.
(Aaron) Sure.
That's better than 150, 000, but still.
(Tyler) Yeah.
But still, way too many that we're going to go through.
(Aaron) Not how you want to spend your Saturday?
(Tyler) Right, exactly.
So what I'm going to do is then I'm going to filter by operation,
and operation are basically all the things that Process Monitor recorded.
So I'm going to focus on two different ones.
I'm going to focus on WriteFile, so anytime this process wrote to a file.
(Aaron) Correct, and that's what we looked at in Regshot,
so now we're trying to attribute what did that.
(Tyler) Right, exactly.
And then I'm also going to do RegSetValue,
and so this is anytime that TrickBot modified anything in the registry.
(Aaron) Okay, great.
(Tyler) So I'm going to do that and click OK.
And, it actually doesn't give us any events, which is kind of interesting.
That means that either we're not looking at the right event
or the right operation or TrickBot did something else in
order to kind of get around that.
(Aaron) That's interesting.
(Tyler) So what I'm going to do then is I'm going to kind of add
a new process that we're going to look at.
So, we know that TrickBot has ran svchost.
However, there's a large number of svchosts on the system,
so I'm going to hold off on that.
Then I'm going to go down to this other one that we saw that was created,
the ttic.
(Aaron) That's one of the files that was created.
(Tyler) Right.
Right.
And we're going to see if that did anything.
And we're still not seeing anything, so, and this is how malware analysis works.
You start by looking at something and then you kind of iteratively go
through and just do more and more to see what you can find.
(Aaron) Make educated guesses about what direction you're
going to take to identify what's going on.
(Tyler) So what I'm going to do, let's start looking at some other operations.
One that is often used is this one called SetDispositionInformationFile,
and this is often used, so if a file gets renamed or if a file gets deleted,
this is the operation that's recorded.
(Aaron) Okay.
(Tyler) We're still not seeing anything,
so we're going to take this from a different approach.
We're not finding the process that's doing this.
We're not finding the operation that's doing that.
But we still want to at least, you know, let's have a goal in mind.
So, our goal right now is going to be let's figure out who copied this tticmb,
that file name over because we did see that in Regshot.
(Aaron) And by who, we mean which process, right?
(Tyler) Which process, yes.
So what I'm going to do is I'm just going to remove all the ones that we added,
and then I'm going to filter on something different.
I'm going to filter on Path ends with,
and then I'm just going to quickly copy this
executable file name here and add that in.
And so now when I click OK,
hopefully Process Monitor recorded some event and some process where this
file was accessed or modified or touched in some way.
(Aaron) Right, and this is process-independent now.
We're looking across all processes.
(Tyler) Right.
And great, so we get a whole bunch.
We have 130 events.
And if we look to see who did that, it was svchost,
at least initially, which is interesting.
You remember svchost was the process that TrickBot hollows out.
So probably what happened here is that TrickBot went in,
it launched svchost, hollowed it out,
and it didn't do anything malicious like copying files or moving files over
until it was underneath svchost or acting as svchost.
(Aaron) Which would be smart for the malware to do, right?
(Tyler) Exactly, exactly.
(Aaron) Whatever is the initial process name is not
necessarily part of your configuration baseline.
(Tyler) Right, exactly.
And we can see here that it wrote the file a number of times,
and in fact if we start looking through here,
we can go to the very last write file,
and we see that at the very end the last time svchost wrote this file,
it wrote it at an offset of about 655k and then a length of 48k.
So if we add those two together,
that will actually match the the current file size,
yeah.
(Aaron) So that's a good verification is what we're seeing,
that we're looking at the exact same file.
(Tyler) Right, exactly.
(Aaron) And we're caught up to current events.
(Tyler) Exactly.
And we can see that there are some other processes which touched this one,
this file; however, if you look really fast through these,
the only one that wrote to it was svchost.
So these could be other normal Windows processes that we're modifying,
and it could be the malware.
We don't know.
But the only one we know for sure that copied that file over was this svchost.
(Aaron) Got it.