So another tool that we should talk about that we'll
probably use moving forward is RegShot.
RegShot is a really great tool,
and it acts very similarly to Process Monitor in that it's going
to tell us what changes happened on a system.
But the way that RegShot works is it takes a snapshot of the system and
kind of goes through your system, looks at the files,
what files exist,
what they look like, and does the same thing for the registry.
And then it kind of saves that snapshot off.
Then you would run your malware, and then you would take a second
snapshot and do a comparison between the two,
and it's going to tell you things like what files were modified,
what registry entries were deleted, and so on.
And you can use that to very quickly go in and see what
changed on your computer and your guest OS.
Got it. So that's like a point in time comparison as compared
to procmon where it's kind of just streaming this registry
change and that registry change, right?
So you get a more holistic view of what happened. Right. That's
exactly what it is. Procmon is more real time, kind of showing you
everything. RegShot Is more kind of comparing two points in time.
And the thing with RegShot too is you're only going to see the
changes that were made.
You're not going to see who made those changes.
I see.
So you kind of have to use both Process Monitor and RegShot together.
And so RegShot will let you know who made the change as well? Okay,
that's an awesome piece of information. That helps, right?
So what else have we got? We have another great tool, Autoruns.
Autoruns, again, we're seeing a pattern here, is another Microsoft Sysinternals
tool, but the nice thing about Autoruns is when you run it,
it will go through, and it will look at every place in your
operating system where malware can maintain persistence.
Right, okay.
Is that essentially the main reason it was created was to look for
malware persistence? Not necessarily malware persistence because I
actually use this tool a lot on systems that aren't compromised, my own
systems because when you install software,
it's going to install all these little hooks in the OS to
auto‑start, and you may not want that. So, for example,
I just ran it on here.
You can see that I've obviously installed Java on here and that the
SunJava has an update scheduler that's set to auto‑start.
If I don't want that, I can use Autoruns to detect that and turn that off.
Got it.
So a lot of these tools are essentially made for just
understanding what's happening in the operating system,
troubleshooting, system administration, that kind of thing.
But we're dual‑purposing them for understanding what
malware is accomplishing as well.
Exactly.
A lot of these aren't troubleshooting tools. We're just
kind of using them for our purposes.
Perfect. Autoruns, obviously,
we would run this after the malware ran. And, really,
we could see the same data in Process Monitor,
but, again, like RegShot,
we can use this to really see, get a quick idea for what is on the
system and potentially how the malware is going to maintain
persistence. Autoruns also is a great tool if you ever have to go
to a system that you think is compromised. Run Autoruns on it and
see if it finds anything.
One of the best things about Autoruns is you can go into Scan Options,
and if your system is connected to the internet,
you could tell it to check VirusTotal so it will actually, it will
upload the cryptographic hash of all the files that it sees to
VirusTotal to see if there are any detections.
Obviously,
you need to be online to do that. It's the hash of the image file attached to
whatever the registry key is and/or service entry or whatever.
Yes, exactly.
And you can also do what's called verify code signatures.
I'm going to do that. And what it does is you can
see here under the Publisher tab,
it will go through and look at all the different files.
And if it's code signed,
it would tell you if that code signature matches. Now
understand just because something has a code signature that
doesn't match doesn't mean it's malicious.
That's not the purpose of the code signatures.
But this is a really quick way to go in and kind of
exclude things that are already verified,
which are less likely to be malware.
Another good thing to go baseline your system. So run these before
you run the malware, understand what's there first.
And then you can understand the changes because stuff showing up in
red right now inside Autoruns doesn't mean it's bad.
It's just a flag.
Right, and I would even recommend baselining your tools so you
understand what your tools are doing to the system. Tools may have
like an auto‑update feature in there that you need to turn off that
you may not realize is in there.
And so if you baseline your tool and you see it all of a sudden connecting
out to some IP address or on the internet somewhere,
you know that that's your tool doing it and not the
malware that you're analyzing.
Yeah, absolutely.