Hello, welcome back in this black crew, we are going to use Kizzie office analyzer to deba the document.
So the committed to this folder on my desktop, Clonmel.
This will be J3.
So I'm going to make a copy of this before I do anything.
I work on the file.
I'm going to rename it with a done
deal C.M.A extension because he already confirmed that this is the same way we did our earlier analysis.
So now we are going to run it with a.
Glazy office, Analisa, so that is open the common problem from here, the search for the.
And then you navigate to this location half of a mile away, typing speed based location presenter.
Now we run the data screen first we run the video of.
And then give it to be touchups, the path to Microsoft Office, so to find it up, you need to open
a check for the path.
Apart from my computer eating program files, Microsoft Office Office 15, so there's no computer power
over here, put could.
And then they are actively posting and putting a closing quote as well.
And then the next parameter e he type of document, which is word and exit condition, in this case,
I'm going to use none so that he will run until the completion and make sure that you are using your
Whicher machine to do this as I am here.
And then finally, the last parameter is the name of the documents.
The document will be, don't you see him?
So that being all the G three to your him.
And before you enter, make sure you are not connected to the Internet because we don't want you to
go out to the network and compromised the system.
The non parameter here would allow you to run as long as he wants to.
So now you can enter and then run.
So the Microsoft Office is today, that means you can see the files here.
And now here you have the animal content, so just go animal content and go back and review the results
of the analysis and you getting this information.
You know, this could mean the vehicle wasn't properly written or he wasn't able to continue because
he isn't online.
So he'll just click, OK, and in here we can see there or to you or else that has been detected.
So this great controversy to terminate this now and immediately, we can see to you our state is trying
to reach out to this is an indicator of compromise.
So you said this nine Y g cease fire is not the delimiter that we thought he was, but actually it is
the actual father is trying to download and screw up and look at the faster the it is doing.
And you can see how that will be.
Right.
You just assessing the template file and over here.
Right.
He's also accessing the file one more time.
And here you can see it is also opening a temporary Internet file folder with the that means he's trying
to reach out to the Internet to download some things.
And here as well, this custom decays quite harmless.
He's accessing the dictionary for the Microsoft Word.
But what is important here is this.
You are ill.
That confirms the indicator of compromise is trying to reach out to this link here to download something.
So where do we go from here?
We can go and download this file.
We still available and analyze it further.
But what is important is that the analysis has succeeded to find the indicators.
We have achieved our goal for document analysis.
So if this indicate a compromise, we can go and block these four from further access and from further
damage in the organization.
So that's all for this video.
Thank you for watching.