Hello and welcome back.
In this video, we are going to do a walk through on VVA Macro's cryptanalysis, if you recall some
lessons ago, he already extracted how we obtained a crew from this fire.
So we are going to make use of this area now for our work through.
Let's take a quick look at this, frankly and openly, visual studio cook, and you can see there are
a lot of obfuscated strings here and here.
So you will immediately recognize the use of the CIA.
Our function, as we discussed earlier, we could manually, the office, get these boxes here, too.
So let's use our tools, the first to try Coeli VBA using the caption and also the revulsion and giving
me the name of the VBA file and redirecting the output to a new file, you call it, in the obfuscated
for the VBA.
So the identity of that option would be obfuscated.
The identifiability is to override file with the obfuscated strings, but we want to upload it to a
different file.
And you said you were writing the original file, so let us now run the program and see what happens.
So he has finished running and you will see now there's a new file here containing the obfuscated script.
So let's open it and see if we chose to.
You could delay or evade us if he will foreshores the original code, thought the obfuscation, and
we need to scroll down.
If you scroll down further down, you will see a summary in a table of all the findings that he has
made.
And we are seeing some new stringers who he had not seen before.
These were the strings which were previously obfuscated initially.
Some eustress related to Bauscher.
As you can see from here.
Bauscher meeran partial command may create or reject using ploughshare internal files on the Internet.
Using bauscher, we see some strings which were obfuscated before some file names, for example, see
script for four four EIC.
And if you scroll down further, we see some more strings Vestris that this program managed to find
in the obfuscate quite a large number of them.
However, this alone by itself does not give us any context in which they are be used.
But if you scroll down, you will see how they are being used in context.
So if you scroll down further at the bottom, you will see that the office version of the VBA script
over here, however, or Avivah is not perfect.
So it might miss some strings, as you can see here, but generally, overall is done a very good job
of the obfuscation here.
We see that it may be trying to do something with the user's temp directory or the Windows temp directory
screen on further.
You see that he may be trying to run some WMI service to get some tasks done.
And you also see some comments here.
Along with some scripts here, so he could be executing some additional files or some additional VBA
scripts.
We also see an easy follower here in this location, this temporary location.
It could be creating this executable in the Windows temp directory.
And right here we see a partial hefted PRL.
So this is obviously a broken up string concatenated together.
So all we need to do is if you can find what is this string, then we can't you should be able to recreate
the entire Yahel.
Let's try to do that.
So we are just going to copy this now and then go to Eddie and find.
And then here.
Find out the occurrences and this is one indication that one and we find it, this variable that you're
referring to, the string.
So now what we can do is replace all this variable video string so we can go to copy this first.
And go to edit and replace, so here we face he the one that you want to replace here, and he put the
original string that you wanted you wanted to replace.
So now he's going to search area of this variable name and then replace it with the actual string itself.
So let's click on this replace or replace all.
And now if you come back to here, you can see that this area can be recreated so we can recreate it
here.
By manually editing it and we get an IP address.
Then let's move on for the.
OK, let's see.
Now, we can go and look for this since you are speaking.
Recreate the.
All right, so here's another one.
So let's recreate the IP address and they have it installed.
So.
Let's see if we can get the full name and if he concatenating this, we will get into the.
E, they hear X and then he EIC, they have it, we have you, I am.
So now that we know that this is an indicator of compromise, we can go to our proxy server, our firewalls,
and see if anybody has gone there to download this.
Oh, we can go in there.
I was selling do further analysis on this binary and we can continue to look and see where else.
All right, clicking.
All right, here's another one.
It's the same one.
All right, it's going to continue.
All right, isn't that so sexy?
And if you look at this line, you will see that there's another string here and the string here is
being used over here.
So if he were to recreate the stream, he will get.
For the U.S. and we find in this spring is actually here, that means we can replace these with for
receiving them STEM forfour for the EIC.
So this may be suggesting that whatever is downloaded is being copied and put in this location with
the different name for.
And if his grandfather from this we have reconstructed, you can see that he may be trying to download
this and put it in this location in the Abdeh to local temp directory, the users, the user name and
date, and look at them directly under a different name, 444, the EIC.
And if you go down here, something interesting is trying to execute the file that he has downloaded.
So we see that whoever has given us a lot of information and some of these are also in the inside the
summary table here, as you can see, some of the table here.
OK, so now that is irrelevant to why Pamunkey.
So let's try to run YPO monkey.
As the screen viper monkey on the original VVA file and see how we get to see enter, so now it is doing
analysis, it will take some time.
OK, this may take a few minutes to run, so we need to wait for it to complete.
His analysis is performing a VBA emulation in order to find malware artifacts.
So I just posted a video for a while and come back to it once he's done.
All right.
Just let it do its thing.
There's a lot of analysis going on here at outracing as well.
Some warnings and some information message.
And eventually you come to the conclusion you meet a nice summary of the NBN and finally has finished
with this analysis.
And here is the result.
So you can see this very comprehensive report that is generated.
It is put in a nice table and the action, the parameters and the description.
So it is found entry point to open and it's also found is the action to delete file.
So he is trying to delete some temporary files here.
And the description, interesting function call to delete far.
Here's a Q queue function to delete the fun and also get on Jacquier interesting function.
And another interesting function call here.
And this open fire it like he also created a temporary file to open it, and these are indicators of
compromise.
You can go and take a look at all this location.
So all this was not visible clearly to us in the he obfuscated maybe a script, but we VIPR monkey has
shown this clearly.
Another open fire is trying to open another we have great father he has created.
And it's quite a lot of things going on here.
Yes, one is Bauscher, so it is going to run a Porsche.
And I don't read the script here.
And so on, and then a batch file here.
Finally, Abd.
And the file here deleting traces of his drug file.
And open fire, so this is as good as running it in the sandbox and executing it.
And they know we are doing this all in remixing a Linux imaging machine, and yet we can see all this
without actually running in a Windows machine.
So you can see the level of information that this monkey has shown us, a lot of it, plenty of indicators
of compris nicely tabulated in a table.
OK, so that is how we do a walk through on the LIBOR McCroskey analysis.
We have already come to a conclusion, our objective for this video.
So thank you for watching and I'll see you the next one.