My Best Ever PC Check.

[00:00:00]I was what user value on a PC check right now. First one of the day, let's go ahead and drag him in real quick.

[00:00:05]Take PC check. Are you going to be able to tell me what bypass was actually on?

[00:00:08]Let's have a little little bit deeper at the screenshot. What bypass is he on?

[00:00:11]Oh, and this is our favorite Zuno. Oh god damn, I can't use a PC check on phase Zuno today. This is going to be way too easy. Way too easy. This guy said he can't talk. What a [ __ ] bro.

[00:00:18]This guy just doesn't want to get [ __ ] voice matched and banned me when I find his ass on everything that I love, bro. Mother's soul. Oh damn.

[00:00:24]Restore?

[00:00:26]Okay, okay, okay. But hold up. Clipboard method? Clipboard method?

[00:00:29]Ah, see this guy actually cleared it.

[00:00:31]Okay, fine. I'll find out. I'll find out. I'll find out. I'll find out. Can't complete, bro. The TTCS scans finish so [ __ ] quick, bro. And this file transfer cleaned at 16:06 at 10, bro.

[00:00:39]That's literally an instant ban.

[00:00:41]>> [laughter] [gasps] >> Uh we weren't banned straight for it straight away, but this is already something. Cleaning out the AnyDesk transfer file, they deleted the AnyDesk transfer file at 10:00 p.m., bro.

[00:00:48]They're trying to hide something.

[00:00:49]>> You can't ban for that. You you are actually >> going to ban for it. I'm not going to ban for it. I'm not going to ban for it straight away.

[00:00:54]Hm. On disk. Anything not on disk? Wait, hold on. Let's collapse entries real quick. Anything not on disk right now?

[00:01:00]No, everything is on disk. That means something has to be here, right? This one had a security change. This one had hm.

[00:01:07]I'll just look at my now. Zero [music] detections so far. Okay, let's keep this [ __ ] going. Let's look at everything ever since this PC turned on. 11:32:59, but then we'll look at the previous [music] boot as well. Hold up. All right, we got everything downloaded in right in my now. We're >> You know how crazy you check this? Go on his AnyDesk cuz he could have cleared and drove me.

[00:01:20]>> Yeah, facts. I'm not going to lie to you. Where's this drill at? Come on, bro. All right, let's do this Z drive.

[00:01:24]So this is the hour, all right. I'll be right back. I'll be right back.

[00:01:28]>> One eternity later.

[00:01:30]>> Guys, stand around. We're still busy checking this guy. Yo, wait here. Wait here. Wait here. Wait here.

[00:01:33]>> Bro, I was doom [music] scrolling on that toilet.

[00:01:35]>> Bro, I'm so real, bro. I just blew up the [ __ ] toilet. I'll be so real.

[00:01:38]I've never blown up a toilet so much in my [ __ ] life. I'll be so real with you right now, bro.

[00:01:42]>> That ass just lost 5 kg on the toilet.

[00:01:44]Weight loss is my passion. Fuel the ops, bro. That's what I'm talking about.

[00:01:47]What's all these?

[00:01:49]>> Does he have everything installed? He doesn't. Let me search this [ __ ] real quick. Hold up.

[00:01:52]>> Wait, is that mmc.exe at 11:50?

[00:01:55]>> Uh yeah, it is. It is. It is.

[00:01:58]>> Well, that's >> It is suspicious, isn't it?

[00:02:01]>> And mmc.exe in logon is a ban, by the way.

[00:02:04]>> No, I'm not banned for that [ __ ] I'm not banned for that [ __ ] bro.

[00:02:06]>> It's very bannable, actually.

[00:02:08]>> All right, before anything here, unsigned up bunch. God damn.

[00:02:14]All right, this win gets service to exe from platform runtime. This [ __ ] needs to be found, bro. Where the [ __ ] virus total at? All right, let's run this [ __ ] real quick. Hold up. Let's have a look.

[00:02:21]Let's have a look.

[00:02:22]>> Yeah, behavior is now loaded. What are the chances that it just gets submitted >> to virus total like immediately after the PC check? I think this looks fairly legit, man. We'll leave that [ __ ] for now. All right, let's have a look even deeper. Hold up. First submission was 2 days ago. It's got a different name as well,.exe. Is it signed? No, it's not signed. Huh. mmc related to this as well. Ooh, we could be getting some We could be getting somewhere.

[00:02:42]>> Wait, this could actually be a Ooh.

[00:02:44]>> Cuz people make [ __ ] >> No, but it's literally >> DLL side loading with services >> I've been the device manager. Hold up. I can check mine. I can check mine. I can check mine. I don't have just device manager the DLL. No, this guy's got his own device manager the DLL. Wait, hold up. Let me show you what this [ __ ] [music] hit Discord at. Let's check mmfte device manager.dll.

[00:03:02]File create date override date extend file create close at 9:59. [music] And there was a close of it at 10:07.

[00:03:12]Okay, well, isn't this suspicious, bro?

[00:03:14]Like >> That date override, that date extend, yeah, that's crazy.

[00:03:17]>> Yeah, no, but it's got to be data truncation. And then nothing else happened to that [ __ ] It didn't change name or anything like that.

[00:03:23]Okay, let's keep going through. Every device manager Why do you want me to open the device manager? Here you go, device manager. There's a different one, default device manager, right? There's another one here, and I don't have this [ __ ] Device manager DLL, this is mine right here.

[00:03:34]>> Maybe check that.dll in detect easy.

[00:03:37]>> I know, I think I want to be smart with it. Hold up. Device manager.dll.

[00:03:41]This one right here, created at 4:39.

[00:03:44]Where's journal at? This is created at 9:29 on the 16th. [music] So, he's re-downloaded it twice. Save files viewer. Let's have a look. Safe files viewer as well is clean, bro. I got to somehow find this [music] device manager.dll. Device manager.dll download. I would not download that, bro. What the I'll download it, but I'm not going to run it. I'm just going to put it in VT, bro. Is it going to be downloaded, bro?

[00:04:07]Device manager.dll.

[00:04:09]The latest one. I I need you to find me the download for device manager.dll and tell me if this VirusTotal link is the valid one or not. I feel like it would also be signed by Microsoft, no? Like, what? Am I Am I delusional for saying that? Am I delusional for saying that or not? Let's see what Gemini comes up with. Hold up.

[00:04:30]While we wait, let's just go ahead and go over to my own free tools through here. The extend file create basic version. Is this still on disk? It is.

[00:04:38]It's 67,000 kilobytes. What the [ __ ] Oh my god, this could be it.

[00:04:43]This could be it. This could be it. This could be it. This could be it. This could be it. Please. Please. This literally got to be it, right? And I swear on this a PE file, too.

[00:04:50]>> I can't actually say it's first time being uploaded.

[00:04:51]>> First time being uploaded? Is it a PE file or not? Is it a PE file or not?

[00:04:54]It's literally such a huge file as well, though. Okay, zero out of one. Zero out of 18. [ __ ] Is it When I try to launch it, it said this Windows file is not associated with any app, bro. I don't know what to do, bro. Is it a JavaScript file, bro? Like, what? Notepad just wants Listen, bro. Something or something like that. Oh my days. This is loads of payload.

[00:05:12]>> That's a payload. That's a rate by bytes rate.

[00:05:15]>> What the [ __ ] Then what is it doing there? Oh my god. Wait, so this is a TMP file full of a payload?

[00:05:19]>> Yeah. Yeah. Control A, hit, send it to an AI and then Or is it No, actually send the whole file to AI because [music] >> Yeah. What the [ __ ] Okay. This guy had MMC MMC and it launched the launched the device hunt DLL and then it ran the JavaScript [music] on this file, which runs a payload. Okay. Okay. Okay. Okay.

[00:05:37]We're actually getting somewhere. We're tracking this [ __ ] We're tracking [music] this [ __ ] on everything. I love tracking this [ __ ] This issue has a payload inside of it. Hold up. Let me see if I can grab this [ __ ] and put it on my MPC and see if we can get AI to analyze it? This file is a [music] raw bytes of a payload. Can you compile it and give me the file? Question mark.

[00:05:55]Right, let's see if we can do this. If not, then we might have to pull out our private method real quick. I can't think I probably have one but my safety guy is assuming generates this thing is you with harmful offensive artifacts. Okay, we're going to have to go face real quick. One sec, boys.

[00:06:06]>> [clears throat] >> A few moments later.

[00:06:08]>> Oh my days. Oh my days. Oh my days. It's finished. It's finished. It's finished.

[00:06:12]>> [laughter] >> Okay, so this is it right now.

[00:06:16]I hold the shellcode into an executable and this is what I got. And it's flagging that it's just a donut executable, but I don't know why because donut is what would have called turned it into a bin file. We're trying to turn it into a bin file back into an EXE for analysis and it's coming up with all of these.

[00:06:29]>> It would found that.

[00:06:31]>> See what strings are inside of it.

[00:06:32]>> That's what I'm just looking at now. All right, we're going back to normal face.

[00:06:35]Donut is a shellcode wrapper. Yeah, I know. That's why I'm saying That's why I don't know I whether it's done it completely right or not. Okay, we're running for the leader. We're running for the leader. We're running for the leader.

[00:06:42]>> He is not getting promoted. He's getting demoted.

[00:06:44]>> Literally the best part. Let me see if this guy can reconnect me. Oh my days, he actually went offline. Yeah, GG's, bro. Damn, bro. That [ __ ] was crazy.

[00:06:50]GG's, bro.

[00:06:51]See you in a bit. See you in a [ __ ] day.

[00:06:57]>> [music]