> Unit 221B ultimately built a “Live CD” version of Linux that victims could run on infected systems to extract that RSA-512 key.
I'm guessing most didn't make it within the 5-min window, so the Live CD would recover the "deleted" record from the Windows Registry database?
> You can’t analyze the registry live on a windows machine because it locks the NTUSER.dat files by the process id (PID) 104 known as Registry.exe. Any useful registry information will be found in that process, and we recommend getting a memory and VAD dump of the Registry.exe process as soon as possible. You can do this quite easily with the REKALL tool, which can perform live and dead memory analysis on Windows machines.
[0]: https://blog.unit221b.com/dont-read-this-blog/0xdead-zeppeli...
“Since Zeppelin deletes the registry key store, we will have to extract unallocated cells from the registry to recover the Public Key section. […]
We have had 100% success carving the public key from NTUser.dat for live Zeppelin samples in the field”
it turns out the registry key that was deleted can be recovered. Much like you can recover deleted files from a file-system, you can recover deleted keys from a windows registry.
In the words of the blog[1]:
Since Zeppelin deletes the registry key store, we will have to extract unallocated cells from the registry to recover the Public Key section. We use a combination of code and existing tools such as yarp and regipy to carve registry information from the hard drive, memory, registry backup, and transaction files. We also need to recover the deleted data. The most successful process used yarp-carve and yarp-print with the -deleted flag against NTUSER.DAT files, which are compressed.
[1] https://blog.unit221b.com/dont-read-this-blog/0xdead-zeppeli...