Hello and welcome back.
In this video, we are going to do the bugging of malicious document.
We are going to use the same file which we have analyzed many times before, using the menu approach
to analysis.
By this time, we are going to use the debugger.
So this is the file that we are going to analyze.
If you have misplaced, it can be downloaded from the resource section.
It is known as Mount Christology and the password to unzip it is cracking lessons dot com.
So after you have unzipped a file, put it in a document in a folder.
I put my desktop called malware in here.
Let's copy the path of this malware location and we'll open a common problem.
So we just ACMD search.
And every chief directory seed space based upon copy.
And now we can run an office just to see the options his press.
And this is how he can use our office or the office analyzer.
So I'm going to run it with the leadership of the charity that is the location for the Microsoft Office.
So to use it to the office, not be in, then that we will be watching for Paff and I have to go and
locate my Microsoft Office installation directory, which for me will be in this location.
Program files, Microsoft Office.
Followed by office huffin and east of the which contains Minemakers office, so I just copy this.
And then I'll put a.
Directly and base and put a closing call, Nashville.
Followed by the next barometer, his barometer will be the type of document that I want to analyze,
as you can see here, my specified time document.
So in this case is work and you can specify any of this or the word Excel, PowerPoint or script.
So in this case is what an experiment would be.
This is actually an essay on this when you want your analysis to stop.
So I will put BRC the other options actually on the before and after the first.
You are an expression or prop.
Before process creation, so how we use prop before process creation, so the last parameter would be
the name of the father, which is in this case, we better duck.
So this is the that this has created another folder called logs, so after you've done that, get into
to do is the debugging, he will launch Microsoft Office work to open the office program itself.
And then here you need to enable content so that they could run content.
And now you go back to your command problem and you see has begun, the analysis and analysis is now
complete.
Sometimes when before I ask you this question, whether you want to add some more fake documents.
So this is to give the malware the impression that you are running a real machine and not to attack
machine.
So if you ask for this question.
Yes, yes.
So in my case, yes, I already answered yes in a previous run.
It not from me again.
So let's take a look at this now.
A copy of this report is also found in the logs here.
So if you open the logs folder, you can open this lock here and read.
Yeah, so you have two copies, so now here I see what happens.
He has found 13, right?
Forty five reads one process to legal process and 015 compares and it has not far in your house.
And these are the files that he has opened.
So the interesting ones will be those which are read and write.
So you can see from here you have three and right.
And so on.
So he's trying to read and write to these numbers and which is a template file.
And then down here and there is another one written.
Right, temporary Internet.
Content that can be so this might suggest it is trying to go to the Internet to download something.
There's another one here, customs, which is quite common for selfies and another reason right here
to the document.
So right here as well for a temporary file that can be in this location and another and.
Right.
And not a temporary Internet file here.
Another one over here.
Right.
You scroll down, you see that it has ejecta to WMI activities, which was also discovered during our
menu analysis before Avivah.
And then we see that this one process creation, it did not detect any Yahel, probably because it has
not reached that stage, because we did not allow it to start the process.
But we did see something interesting here.
And the process creation is since then, our Web scribe is trying to execute this batch for the bakdash
update that in this location.
So that is good to see what's happening there.
So we open a window explorer and this is a location C.
User's PC, so go to users PCs and then my computer might be different from yours.
So he has had data so you can see at the time because it's a hidden file.
So we need to type in manually Ed Natus and then go to local, stamp local and go to temp and scroll
down and we see the tree, Fouzia one, two and three or four bauscher script and we script.
So according to our office, it is going to execute Adobe ABCDE that which is this far.
So let's open it first and analyze it.
We're not plus plus.
And as you can see here, there's a Pinkham man and he's going to ping this IP address twice.
Now, the purpose of this is to put in a delay.
So over here we see also that there are two variables where one, two, three and four.
And and this one, one, two, three and four is being concatenated here to create a string Siwa for
essentially the string.
And then you can't get in any real one, which is a dot continue to evolve to which is a V four or five.
All three, which is V, so it is trying to create a string ending the other bakdash of the dot VVS
and finally is going to execute it.
So that suggests a second part is going to execute these other B abcde abdeh dot vvs.
So let's open this now and see what happens.
Open it.
Not bad.
So now is going to execute in this script and here under the variable current file is trying to generate
another string.
So let's combine this string here and see what we get.
And so we can see is going to execute this script.
There'll be ABCDE Desha Paswan, which is a PowerShares script, and then the next line here, the last
night objectional run, is where he create the string power shell and then execute that to execute this
current Fani, which is coming from here.
So next fall it's going to execute the script with this one.
Perhaps if I were to concatenate the strings, you might be clearer for you, so there you go, publisher
and then is going to execute this script here, Khilafah.
So now let us go and see what this show is going to do.
Let's open it, if not Pat.
And here we see the script where the document is going to actually go out and download something from
this location and then probably save it in a different name for the DLC and all this we've already seen
before when we are manually analyzing and using eBay and other tools.
And if you look further down, we see online here, this is where the file that has been downloaded
is being executed from the stand directly dislocation.
And if you go down here, you see on 16, 17 and 19, it is trying to clean up the website and find
some other file.
So this is an attempt by the malware to remove any malware artifacts from the system.
So as you can see, it's so much faster using an office to debunk this and get all this information
out without actually allowing the process to be created.
So we were manually able to use static analysis earlier to go and feature all this information, bits
and pieces all over the place.
But they did not show us in context how this thing actually fits in.
But when we ran the thing using our office, we see the whole picture, how he actually starts and gives
a better understanding of the email.
Right.
And we could do this is the office analyzer without having to the office, get our fix any kind of code,
encryption or encoding.
And because all of this is automatically done for us and our office was has managed to break the correct
API calls and examine its parameters and extricate all the necessary strings, the important suspicious
one.
So this is how useful using a debugger is, even analyzing a malicious document.
So that brings us to the end of this.
What thank you for watching.
I'll see you in the next one.