In this demo,
we'll use RegRipper to detect exfiltration of data over a physical
medium. Data exfiltration using the USB drive is a very common
technique used, not only by red teamers and attackers, but also
internal employees themselves.
So analyzing USB device information on a system is relatively straightforward,
but the tricky part is to ascertain if any date I was copied onto the USB drive.
During this demo,
we will be first analyzing the USBSTOR registry key in the system hive,
which stores valuable information regarding the USB
devices connected to this system.
MountedDevices key is useful when you want to correlate the drive letter
assigned to the USB drive, and then we will analyze the MS Office
RecentDocs key on the NTUSER.DAT registry hive.
This key will provide us with recently open MS Office
documents along with their full path locations.
So let's go back to our demo environment.
Let's set up again.
We'll use the SYSTEM hive and the plugin usbstor, so this is the output.
We can see the registry key used by RegRipper, ControlSet001/Enum/USBStor,
and then we have the information regarding the USB devices that were
connected on the system. As we can see, in this case,
only one device was ever connected to the system.
First,
we have the vendor named SanDisk and the product name, Cruzer_Blade, and
then we have the FriendlyName here, SanDisk Cruzer Blade USB Device.
FirstInstallDate will give you the time the USB device was first plugged
to this system, and Last Arrival will give us the last time the USB was
plugged to the system.
In this case,
the USB was connected only once to the system, hence
the first and last times are same.
But the most important piece of information we get from the USBStor
registry key is the unique serial number of the USB device.
Every USB drive has a 12‑digit unique serial number,
and this can be used by the operating system to identify and track multiple
USB drives when they are plugged in again to the system.
Also,
it's very useful for our analysis as we can now correlate the
unique serial number in the mounted devices key to find the drive
letter assigned to the SanDisk USB drive.
So we need to make a note of the serial number here,
beginning with 4C53. The next step is to find the drive
letter assigned to this USB drive.
So now, let's executor the plugin mountdev, and we have
the output from the mounted devices key.
And here, all of the drives ever mounted on the system are shown.
We can see the drive letters here, A, D, E, and C.
You can clearly notice here the serial number of the SanDisk USB
drive, beginning with 4C53, so we can now conclude that drive letter
E was assigned to the SanDisk USB drive.
Now, once we have the evidence of a USB being plugged to the system,
the next step is to find out if any documents were copied to the USB drive.
So this time, we will use the NTUSER.DAT registry hive and then the
plugin msoffice and hit Enter. This plugin will check the contents of
the msoffice recent docs key and extract the Word, PowerPoint, and
Excel‑related entries for analysis.
Let's start with MS Word documents.
Here, we can see many recent documents opened from the C drive, but the
Secret Plan document was also opened from the E drive.
And as we know from the USBSTOR and MountedDevices keys, E
drive was assigned to the SanDisk USB drive.
So this way, we can conclude that the Secret Plan document was
copied to the USB drive and then opened from there.
Similarly for PowerPoint,
the Clients Presentation File.pptx was opened from the E drive as well,
so we can conclude that this file was also copied to the SanDisk
USB drive from the C drive location. And finally,
for Excel,
the file Clients List sheet.xlsx was also opened from
the C drive, as well as E drive,
meaning this file was also copied to the USB drive. Before concluding,
another thing of interest I want to point out is that in all of these
cases, since we have the full path of the files,
we also get to know the folders inside the USB drive where the documents were
copied to, which in this case is the Globomantics USB folder,
which must be present on the SanDisk USB drive.