How can they know they are going to save this file?
The process injection CBB could and they are going to compile it.
So this select this path here rightly and cockpit.
Going open your eyes for native tools, come on from.
And change to the radar screen, and you have copy and confirm that you are in the right territory and
that the compound that he's present, you know, around the compadre script.
The SFA has been successfully built that will be contested.
But before we can test it, we need to run the Microsoft Paint program.
So yesterday, maybe not the AC and hit enter,
and now that Microsoft Paint is running, we can run our Melby, which to process injection Yasi hit
enter.
And immediately I can hear some notification some and at the same time.
This message pops up.
And he says hello from tracking lessons, Dotcom and Titus's Chalco.
And there's also an information icon since we specify in the Metasploit anyone that this icon.
So how do we know that Shirley came from Microsoft?
Look, we can open process hacker to investigate if.
So in process Hacker, you will see that because I've been running so double thing on it.
And then you can also see it from the apple here at the pad from crispiness five to zero.
And then here this is Microsoft P.
And you can see from Intel here, the princess ID is five to zero.
You can also see the process ID in this column.
Five two zero.
So we can you can some interpretation column here.
By clicking on it and then scroll down to look for the region of Mimmi, which is readable and executable,
and then you will find here.
There are many regions of memory which are readable and executable.
All of them belonging to dear buddies, one which is unmarked.
And this region of memory.
He can double click to view the contents.
And this is I wish I could.
To confirm that this is indeed an Chako, and you can look at the last few bites here, which shows
the text of the show, including hello from clicking lessons dot com, and also the title for the MessageBox.
And then you can also open our.
Open the Sherko in case Ed, he takes the sex ed.
So if you put your Hex editor survey site, Mutty region and memory for Microsoft, Bing, you can see
here easier to compare.
So advice on the same FC four eight four eight eight one EFO.
And here in the last few months.
So the identical suit is confirm that they chako indeed.
Is that because I've been shako and also it is residing in the memory space of Microsoft PIN, which
is here in this memory of Microsoft pin.
This is the allocated memory our malware has created.
Another thing you can do is you can make use of a special to incite a process hacker.
He said to hear finally windows in three, so you can click on this and drag it to over to the message
box in release.
And and then you will see he will show you the pattern for the messagebox in this case, he's mad because
I've been here to press this idea of five to zero.
So these are so confirmed, stay in these messagebox came from I guess I've been he calls me because
I've been paid five to zero.
And also, I can see from here.
Right.
So this is how we can build our malware.
They can inject shellcode into a remote process.
In this case, Microsoft Paint.
And this is how we can test using process hacker to confirm that it is working.
So that's all for this video.
Thank you for watching.