So we know where the TrickBot is, right?
We know what it did so far is it copy itself over,
but remember, we saw it kind of die and then re-execute,
right?
So how is it doing that?
We want to figure that out.
And we did get a hint of that.
Remember we see,
in Regshot we see the files added of this new task called Speed lan library.
So it looks like maybe it was creating a scheduled task for this.
(Aaron) Right, is taskeng.exe,
is that the executable associated with scheduled task execution?
(Tyler) Yes, it is, actually.
So that's actually a really good way, you know, you're right.
I mean, the fact that taskeng was running and it was accessing this,
our TrickBot module definitely also leads to the fact that
we're dealing with a scheduled task.
(Aaron) Got it.
(Tyler) And in fact, if we would go up in our Regshot output,
kind of in the middle here of the values added,
you can see where these tasks were created called Speed lan library.
I'm going to be thorough.
I'm going to go in here and I'm going to launch the Task Manager.
I'm going to go to the Task Scheduler.
(Aaron) Yeah, make sure it's still there.
(Tyler) Make sure it's still there and see really what the settings for it are.
(Aaron) Yeah, what's the triggers and what's it trying to do.
(Tyler) Exactly.
So, I'm just going to go down here and click on Task Scheduler Library.
It's a little bit slow.
And here we have, here it is, Speed lan library.
You can see they even put in a description of New speed lan library,
so if I was some random administrator or user,
I would just see, oh well, this looks legitimate.
(Aaron) Yeah, it sounds totally legit, right.
(Tyler) The triggers, it starts at system startup,
so now we know how it's remaining persistent.
When the system reboots, this is how TrickBot's going to start it back up.
And then you can see that it actually will restart itself every 11 minutes.
So if we do get on here and we're smart enough to figure out,
oh, well, here's TrickBot.
I'm just going to kill the process,
11 minutes later it's going to start up again.
(Aaron) Got it.
Is this the only persistence that we've seen so far?
(Tyler) So far, yeah, this is the only persistence.
And we can,
here we verified that what it's doing is it's launching our TrickBot executable.
And in fact, in looking at this, we're not seeing any other persistence.
(Aaron) Not at all.
(Tyler) But we can verify that.
We're going to run one more tool.
I'm just going to close Process Monitor.
(Aaron) Before you close Process Explorer,
I was curious if we can, because the svchost at the bottom,
that's the malicious one that's hollowed out,
right?
(Tyler) Yes, yes.
(Aaron) Can we hit that and look at its TCP activity?
Is that an option?
(Tyler) Oh yeah, absolutely.
So I'm just going to click up here on TCP.
One thing that I always recommend is turn off resolve addresses
because it's going to make it a little faster,
and if the attacker is watching that, they're not going to do anything.
But you can see, oh, there it went, really fast.
It's sending out something.
And you can see here, notice the port that it's sending it to is port 447.
We're going to see that later.
(Aaron) Okay, great.
(Tyler) But yeah,
and so it's definitely going out and it's definitely
trying to connect to the network.
Right now it looks like it's not able to because the state is SYN_SENT.
It's not making a complete connection.
(Aaron) Right, it's not able to reset, yeah.
(Tyler) Right, it's not able to do that three-way handshake.
What that means is that this version of TrickBot,
its command control channels have probably been shut down or moved.
(Aaron) I see, okay.
But that's okay because you know what,
I infected my system before and we have a bunch of network
traffic that we're going to look at.
(Aaron) Awesome.
(Tyler) But yeah, let's jump back to persistence really fast.
There's one more tool we're going to run.
And we talked about this tool in our previous Play by Play,
but this tool is called Autoruns.
Let me get to it.
(Aaron) Good old sysinternals.
(Tyler) Yeah, sysinternals, Mark Russinovich makes some pretty amazing tools.
(Aaron) Absolutely.
Is there a reason you're using the 64-bit as opposed to the x86?
(Tyler) Because I'm on a 64-bit system.
I don't think that there would be any difference, but why take the chance?
Immediately when it starts up,
it's going to start going through and doing things.
And you can see down here that, hey,
it found this Not verified interesting thing here that's our malware.
In fact, if we wanted to, let me cancel this.
I'm going to change the options a little bit.
I'm going to tell it to also check against VirusTotal.
So it's going to be uploading the hashes.
(Aaron) Yeah, and another benefit of having it connected to the internet.
(Tyler) Right, exactly.
And so this is going to take a little bit.
So it's going to go through and check all the hashes,
and then it'll tell us how many places on
VirusTotal have actually detected this.
And eventually our malicious process down here, oh, right away.
41 out of 70 systems are antiviruses on VirusTotal detected this, yeah.
(Aaron) That's a successful detection of TrickBot there?
(Tyler) Yeah, and if we would sit here long enough and let it go long enough,
we would see that, at least with Autoruns,
it wasn't detecting any other persistence mechanism.
This is the only one.
(Aaron) Right.
I wanted to take a second,
and I think we skipped over how easily this malware
ran on our VM that we had set up, right?
And so in the malware analysis lab setting up Play by Play,
we talked about all the different things we can do to
make it look like a real boy so it'll, the malware will actually execute.
And it seemed to execute no problem.
And including using Process Explorer.
So it wasn't looking for Process Explorer because we didn't change the name,
right?
(Tyler) Right.
Or if it does, it doesn't care.
So yeah, TrickBot is one of these where it has a lot of protections in place.
That could be the reason why it just doesn't care about
Process Monitor or anything like that.
(Aaron) Oh, it's advanced enough.
It's like, go ahead and monitor my process.
That's fine.
(Tyler) Right, exactly.