Another tool that we're going to use is Process Monitor.
This is another Microsoft Sysinternals tool.
It's free.
But what Process Monitor does is it kind of watches what's
going on in real time on your system.
The nice thing about Process Monitor is that it will go in and it will
tell you which processes are writing files, which ones are modifying
registry keys, and so on, and you can actually see what they're
writing at least into the registry.
With the files, you can see how much data is being written to it.
You can't necessarily see what data is being written to it,
but it gives us a way to tie back who is doing what on the operating system.
Got it.
And, again, what I'm going to do is I'm going to right‑click on this.
I'm going to run it as an administrator.
I'm seeing a pattern. And you'll see that it's immediately going to start.
It has a great filtering interface.
So some of these things I'm just going to turn off for the moment.
Turn off these filters, click OK,
and then it starts recording everything that's going on in the
system. So this is historical, and this is actually going to be
leveraging RAM as well, so you can't run this forever. You can't
run it forever, but I've seen Process Monitor on a VM collect 8
million, 9 million events.
Okay, right.
You run this.
You have this recording, probably minimize it.
Run the malware and then you'll go back in.
You'll click this little magnifying glass up here,
and that stops the capture, so then it's not capturing anything
anymore. And then you go into the filter interface,
and then you just start filtering down. The filtering
interface in Process Monitor is amazing.
And so what you would probably start doing is go to
Process Name, choose the process,
your malware process. That you found in Process Explorer. That
you saw in Process Explorer, or at least the original file that
you executed, and you choose that.
So I'm just going to choose Process Explorer here. Then click
Add. And you're going to see here in the lower left corner, right
now it's showing about 15,000 events.
If I filter down to just Process Monitor, it actually
doesn't show us anything because apparently Process
Monitor... It has an anti‑filter. Right. Oh,
yeah, you're right.
So let me remove that one.
Let me choose a different one.
Let's see here, svchost. There should definitely be some activity with
svchost. Click Apply, and you can see that it still filtered it down to
about 2700 events out of a possible 168,000.
Okay.
And we can filter it down even more down to the different
operations, and we're going to use this tool to see what
our malware is doing. Got it.