Okay, so we've got Autoruns and RedShot, what other tools are we using?
I guess that's a lot of OS stuff that we're monitoring
changes to, file changes, that kind of thing.
What network tools do we have?
‑We're going to look at one more tool, and this is FakeNet.
We kind of mentioned this before.
This is the tool that we run on our guest OS here, and it's
going to basically act like the internet. It's going to
intercept all of the traffic going out from the computer and
respond to it so that the malware,
when it tries to do a DNS request or connect to a web server, FakeNet
will record that and respond to it so the malware thinks that it's
online. ‑Excellent, so it's is going to respond to the DNS stuff, it's
going to respond to HTTP traffic,
hopefully any other type of C2, command and control, going out or
maybe a stage or pulling down a stage. ‑Yeah,
you have to remember, it's not, you know,
it's not responding intelligently.
It's not doing something like if the malware tries to go to google.com that
FakeNet will actually go to Google and return that page, it's going to
return like a generic page. And it doesn't know specific command and
control servers for malware, so if malware tries to connect to something
and it expects a specific response,
it's not going to get that from FakeNet, but at least we'll see
that connection and then we can kind of iteratively take our
steps forward in order to get the malware what it needs to see
how it behaves each time.
‑So you can see what it's asking for. Next time we run it,
we can try to get what it's asking for to give us more information.
‑I'm going to run FakeNet from the command line.
You don't need to, but I'm going to do it because I want to give it one option.
I'm at an administrator command prompt, and so I'm going to run
FakeNet, and I'm going to give it the ‑l option. I'm going to file
name, and I'm just going to call it log.txt.
And what this does is it will tell FakeNet to log all of its data that it's
seeing to this file, log.txt. By default, it does log all the packets in a
peek at format so we can go in and see that. But I also want it to log all the
messages too, just so I have that as well.
So I'm going to run that.
‑Okay, great.
‑And FakeNet is starting up.
You're going to see some messages.
You might see some error messages and so on,
but right away you can see that it is actually working.
Microsoft saw this new network came up and wanted to do this
connection test, and FakeNet responded to it.
And this is exactly what the FakeNet responses look like.
And, yes, malware, if it's smart,
it's going to look for these FakeNet responses. But at
least we know that it's working.
‑And if you want to go a step further you can customize responses. ‑You
can, you can. FakeNet has a great configuration file.
You can go in and customize responses, you can set up specific web servers.
You can even do things like, FakeNet will even run on Linux.
There's a Linux version. So you can go and you can modify it and set it up
into that system setup that we talked about earlier.
‑So FakeNet is going to simulate the network, we can change
configs, we can also set up other web servers? ‑Yeah,
other web servers, other FTP servers. FakeNet even has what it calls
a dummy listener in it so that if something goes off onto some weird
port it doesn't know, it'll just kind of throw that to it and it
will long that connection.
FakeNet's even smart enough that if the malware or whatever
program tries to go directly to an IP address and not through
a hostname, a DNS resolution,
it will be able to grab that as well and make the malware think
that it's actually going to the IP address.
‑Yeah, that's awesome.
And I see it now too, its logging the process IDs and the service names
that are doing external connections and TCP connections,
which is that OS kind of EDR perspective versus the network
monitoring perspective and linking those two together that really
helps us identify things in our network.
And you can see, we talk about baselining, this is exactly what you want to do.
Like we said, Windows is doing a lot of traffic in the
background, and that's what we're seeing here.
And so it's really good to run FakeNet for a little bit and
look to see what Windows itself is doing so that we can,
when we do analyze our malware,
we know what's Windows versus what the malware is. ‑Right, so we're
running our tools not just to get the EULAs done,
but also to kind of get some logs down and establish a baseline.
So in case we're not sure something was supposed to be there or not,
we can go ahead and refer to our earlier logs or refer to our earlier
state, because you can save the stuff from ProcMon, right?
‑Absolutely.
‑So you can save that down and refer to that as well? Was this
there before malware? Well, if you don't say that,
you can't tell.
So at least like save everything down,
run everything once, and you're good to go.
‑Yeah, absolutely.