Welcome to a new session so far in this cause, we have been trying to use menu methods to do analysis
now in this session.
I'm going to show you a faster way to do analysis to extract the indicators of compromise.
We are going to use debuggers.
So in this video, I will introduce you first to the principles of using debuggers in document analysis,
the learning objectives of this session.
Our number one, why debuggers work?
And we do want to monitor Gangotri debugging tools.
Now, all programs and scripts are actually making calls out to operating systems, API functions.
Take, for example, the script here.
So take, for example, this line here.
When you call the function create text file, you are actually calling the file API function in the
operating system.
And then, for example, over this line, right line code, when this is being executed, you call the
function the API function.
Right file.
And then when you call the close here, you're actually closing the operating systems API, which is
closed.
So because of this behavior, it is possible to track or put a break on this API calls.
So whenever an operating system is being called by indirectly, we can pass it to some breakpoints and
analyzed parameters as well as the return for those calls.
And that will give us our indicators of compromise.
Now, there are many API functions in the operating system, however, there are few which we should
be looking at for the first one of our operations APIs, for example, create for the viewer a right
file and then Hastey TPA operations, for example, Internet craniofacial.
And these two API calls who break up you are into each component parts and it is the operations, the
process operations, which example create process.
Debuggers useful in order to help us to find out what the malware is trying to do, because you can
intercept all the break points in the APIs, which are caused by the scripts themselves.
So as I mentioned before, if Scribbly Salchows create text file to call API from the operating system,
in this case, you can only create file.
And here we can break and then find the parameters to the file and some of the things we can examine
as well.
When the EPA is now a very useful Python script, we can make debugging easier for analyzing office
documents will be lazy.
Office analyzer.
Analisa, this program will be able to extract you are El's found modifications and execute programs
and he works on Microsoft Office, Word, Excel, PowerPoint and JavaScript.
So if you are running a PDA, we has got JavaScript inside it, then if you will get well, this is
the website where you can get more information.
This is what he looks like.
The Seitzer.
And this you are, Al.
To run the program, you can take the name of the Python script, followed by the first parameter,
which is one of these types, word Excel, PowerPoint or script, and then the second parameter will
be the condition where you want to start the program.
So there are few conditions you might want to exit the program.
When he hits you first, you are going to extract it for yourself.
You could also exit this program when he finds the first process.
Or you can put none when you put none until completion, so if you put none, the malicious document
is given a free rein to run until completion.
So this is the most dangerous option.
These are the lazy office analyses, prerequisites.
First, you have Microsoft Office.
In our case, we already started Microsoft Office two or one three.
Second, we need to download and install it because lazy office analyzer requires it.
Then we need Python two point seven because Python two point seven is use by the next three scripts
below.
For P and Capstone, we can use to install for Windi, but we adiba, we need to install the 64 installer
since we are using Windows seven fogie and install from the installer.
So that's all for this video.
In the next lesson, we will install all the prerequisites for the office analyzer and will also download
the office analyzer from this link here.
So I'll see you in the next video.
Thank you for watching.