🔴 Malware Mondays Episode 01 - Identifying Malicious Activity in Process Monitor (ProcMon) Data

Here it is, the inaugural episode of Malware Mondays! This series will provide a malicious artifact for you to analyze on Mondays, and a follow-on live stream on Friday to review that artifact. The goal will be to learn a specific tool, technique or a combination of the two. This weeks artifact can be found under the title of "MM01 - Analyzing ProcMon Data" at:
www.thecyberyeti.com/malware-...
This live stream will answer the analysis objectives and provide you with basic usage of ProcMon. If you're interested in seeing how I captured this data, make sure to check out this video for a "behind-the-scenes" look:
• MM#01 - Behind the Sce...
Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 www.pluralsight.com/authors/j...
🌶️ TH-cam 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 / joshstroschein
🌎 Follow me 👉🏻 / jstrosch , / joshstroschein
⚙️ Tinker with me on Github 👉🏻 github.com/jstrosch
05:03 Livestream begins

[@tar.gzip.malware]

Thanks for sharing this, you are a fantastic teacher! Looking forward for more content 🦾

[@jstrosch]

Thank you so much for the kind words and the support through the super thanks! This is my first one and really means a lot :) If there is anything else I can do, don't hesitate to reach out.

[@tar.gzip.malware]

Thanks for sharing, your effort is very appreciated!

[@jstrosch]

You're very welcome, glad to hear you enjoyed it!

[@bluebadgersec]

Awesome! Please, please continue the series!

[@md.mahimbinfirojavi9676]

Wonderful content. Thanks, your explanations are very easy to understand. Keep it up please :)

[@Hartley94]

Thanks for another insight ❤.

[@jstrosch]

You are so welcome

[@PygArguss]

+1 for the liquid dnb at the beginning

[@jstrosch]

Thanks! I have no real system to picking the music other than I think it sounds good :)

[@cyber_chrisp]

Great work!

[@jstrosch]

Thanks!

[@Manavetri]

Brilliant content !!

[@jstrosch]

Thank you :)

[@Cochise85]

Great stuff 👍

[@johnnywilliams2641]

awesome

[@jstrosch]

Thank you :)

[@user-ik5fk6qn4z]

In the command line for Conhost.exe (3804) what does the parameter "0xffffffff -ForceV1" signify?

[@jstrosch]

Here's a great answer on LinkedIn from a colleague - www.linkedin.com/posts/ryanjchapman_dfir-blueteam-cybersecurity-activity-7057458353047801857-_BVK/. This should answer your question!

[@user-wf3to8uw1m]

great content but it is difficult to follow without known the passowrd to unzip the pcap.What is the password to unzip the pcap?

[@jstrosch]

It's posted on the website where you download it - thecyberyeti

[@ghibbster]

is there any way to spot process injection in procmon logs? @jstrosch

[@jstrosch]

Not that I'm aware of with ProcMon. I've looked/asked around a bit and nothing has come up. If you do find something please let me know, I'd be happy to make a video out of it!

[@ghibbster]

@@jstrosch never mind, I extensively looked for an answer in my past without any success ... probably there is no means at all.
Edit: Thanks btw

[@jstrosch]

@@ghibbster Good to know we're at least finding the same lack of results... thanks for the update!