Hello.
In this video, we're going to do a practical walkthrough on this view injection, so use the same folder
that we did in the previous lesson.
So we're going to build it.
So let's open the access for suits come on front.
And you never get to this holder so quick on this stuff.
Right click Copy.
Come back to your ex FCC for analytics tools and teach directly to it and then compile the program by
using the compile script you enter.
So now it he or the.
And you should open the Microsoft Pay because the target is Microsoft.
So let's run Microsoft Paint.
And because of pain is running now, we run our ESG, our now they.
You enter.
And you will see here he brings up the iPad for Microsoft Paint two three zero eight.
He also prints the address on eBay.
The remote villages and local villages because that was what he wanted.
He wanted to inspect the addresses, S5e putting all those information here.
All right, so now you're going to do some analysis so you can see that the payload, he said, his
address.
So let's go to this address by using Process Hacker.
So in process, hacker, we can look at the address of the bill.
So we go to this now menu injection and here were two one four zero zero one zero zero zero.
He would be different for your case.
Over here, one four one zero zero zero.
So just a click on this and that is your bill.
Here is your Peter Yoshiaki that is supposed to show the message box over here.
Now let's take a look at another one local view.
So local, you will be this address.
One, he followed by four zero zero two once he.
We'll hear one see four by four 00 p.m., and you can see over here is the same tale ending with these
strings, so this local view is to a view to the new section in the local process.
All right, now, let's take a look at the remote you so for can remove you.
We will go to the Microsoft Pink, which is over here.
This is the target.
So look for this address in the Microsoft Paint two eight five four by four zeros.
And here it is to a five four zero, so double click on it and you will see your period is over here.
Here to hear the strings for the message box.
So this is the remote view that is mapped from the target process, which is Microsoft pain and back
to your malware.
So this is how your view code injection works.
So let's continue with the execution of this presenter.
And I can hear you and me at the same time pop up box has shown here.
So if you use this tool here.
That's closest he is to here finding new and to the pop up message box and released.
He shows you the parent for this pop up message box is Microsoft Paint with process bad two three zero
eight matches this one here and also matches the same two three zero eight.
You head over to the memory section and scroll down to the the archives executable section and the protection
you should be able to find elsewhere.
Over here, two, eight, five four four zero.
And this is a landmark session.
And here you see your chocolate.
From here to here.
So this is see how you do your menu coordination.
The practical walkthrough, thank you for watching.
I'll see you the next one.