Hello everyone.
In this video you are going to learn how to analyze case files.
What is Typekit?
Typekit is a file that is saved in the initiators local disk during an RDP remote desktop protocol session.
The RDP file is used to increase the speed of the RDP session, especially when connecting over slow
or low bandwidth networks.
Forensics value of the RDP cage.
RDP cage can be a valuable source of information for investigators trying to piece together an attacker's
actions on a compromised system.
The case file may contain screenshots taken by the attacker during their session.
These screenshots can provide valuable insight into the attackers activities, including what files
they access, what commons they executed and what actions they took on remote system.
RPC file location in Windows 7 and above.
We can find the RTP bitmap cage in the following directory.
C users.
The username.
Appdata Local Microsoft Terminal Server Client.
Cake.
There are potentially several different files under this folder.
The first will be a file name BC, dot BMC and the others will be cake.
X x x x dot bin.
X's are replaced by numbers, start with 0000 and increasing in sequence.
For example.
Kate zero dot bin.
Kate 0001. bin Et-cetera.
The BC file extension is appended with the numbers 222 or 24 which represent the quality of the images.
We know that the higher the number, the higher the quality of the bitmap images produced.
Our system creates a separate cage file for each of the RDP sessions.
Timestamps can be used to distinguish these files from one another.
Passing cages with BMC tools.
BMC Tools is written in Python and can be easily run on both Linux and Windows without command line.
We can parse the bitmap files using BMC tools and continue our investigation.
Let's look at the common line.
Python.
The standard phrase for executing.py files as flag is used to specify the source directory.
The flag is used to specify the output directory.
And here you can see we have successfully exported 526 files, Rdpc, stitcher, usage and analysis.
Open the application and add your parse folder as a new case, then combine the bitmaps.
Now let's apply what we learned.
I want to show you where the case files are stored.
Go view and check hidden items.
Then go to see.
Users.
The username then Appdata.
Local.
Microsoft Terminal Server client.
And Kate's here.
You can see BC 24 BMC file and the three bin files.
It means that we have established three RDP sessions before.
For this video I will use another RDP file.
It's time to analyze the RDP case files.
First we need to pass the RDP case files with BMC tools.
Let's type CMD over here.
And open a terminal, then type python three.
BMC tools, Dot PY and H.
We will specify the source directory with dash s.
We will also specify the destination directory with dash t.
If you want to limit the number of bitmaps we'll extracted, you can use dash C 200.
Maybe dash V for verbose information.
Dash all to extract the old bitmap data found in the BMK file which is used in Apple computers.
We will use dash P flag to provide a big bitmap aggregating all the tiles.
Use dash W to specify the number of tiles per line of the aggregated bitmap.
Default is 64.
Now let's clear the screen and type the command for BMC tools.
Before we move on, we need to create the folder named output.
Then run the command.
We've just successfully exported 526 bitmap files.
Let's look at them.
The black screen might be related to the command line on the screen, and the blue ones might be the
PowerShell.
Let's keep scrolling down.
Oh, I think these screenshots might be the output of a command run in cmd.
I think the command might be ipconfig because we can see the address IPV six local.
So let's keep investigating.
We can see the time.
The temperature.
I think these bitmaps belong to the telegram application.
Yes, we can see the telegram.
A person.
You can see some messages.
And also the name that the attacker has spoken.
WI fi.
A chat message.
You can also open the bitmap by clicking on it.
I think this is the bitmap from Microsoft Edge.
And this is the website cyber exam, I think.
Cyber exam.io might be the domain name.
The review part is over.
We can continue with the teacher application to combine these pieces together.
Let's go back.
And open the exit of Stitcher.
Click on file.
New case.
And select output.
Loaded 526 styles.
Okay.
As you can see, the bitmaps are listed here.
There is the autoplay button, but I do not advise you to use it because it generally fails when combining
the pieces together.
Okay, let's start.
For example.
Let's go here.
Left click.
And left click again to drop it.
And I think this is the correct piece for here.
Also, this tool provides you a great option that I will show you in a minute.
Let's click on this square.
When you hover your mouse over the bitmap, you can see that it completes.
I don't think this is the correct piece.
I will move on to the next one.
And yes, this is the correct piece.
Then I want to click here.
Is this the correct piece?
Or this one?
Both seems true.
But I think this is the true piece.
If you would like to remove a bitmap, you can double right click on it and remove.
This video is over.
See you on the next video.