Scenario:
One of the SOC analysts took a memory dump from a machine infected with a meterpreter malware. As a Digital Forensicators, your job is to analyze the dump, extract the available indicators of compromise (IOCs) and answer the provided questions.
Tools:
#1 Respuesta: c95e8cc8c946f95a109ea8e47a6800de10a27abd
What is the SHA1 hash of triage.mem (memory dump)?
Obtención de la evidencia
sha1sum Triage-Memory.mem
c95e8cc8c946f95a109ea8e47a6800de10a27abd Triage-Memory.mem#2 Respuesta: Win7SP1x64
What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)
Obtención de la evidencia
esta información que nos piden lo podemos sacar mediante kdbgscan o imageinfo
vol.py -f Triage-Memory.mem imageinfo
Volatility Foundation Volatility Framework 2.6.1
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418
AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (/opt/cyberdefense/DumpMe/Triage-Memory.mem)
PAE type : No PAE
DTB : 0x187000L
KDBG : 0xf800029f80a0L
Number of Processors : 2
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0xfffff800029f9d00L
KPCR for CPU 1 : 0xfffff880009ee000L
KUSER_SHARED_DATA : 0xfffff78000000000L
Image date and time : 2019-03-22 05:46:00 UTC+0000
Image local date and time : 2019-03-22 01:46:00 -0400#3 Respuesta: 3032
What was the process ID of notepad.exe?
Obtención de la evidencia
El listado de todos los procesos lo podemos sacar mediante: pslist
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 pslist
Volatility Foundation Volatility Framework 2.6.1
Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit
------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0xfffffa8003c72b30 System 4 0 87 547 ------ 0 2019-03-22 05:31:55 UTC+0000
0xfffffa8004616040 smss.exe 252 4 2 30 ------ 0 2019-03-22 05:31:55 UTC+0000
0xfffffa80050546b0 csrss.exe 332 324 10 516 0 0 2019-03-22 05:31:58 UTC+0000
0xfffffa800525a9e0 csrss.exe 372 364 11 557 1 0 2019-03-22 05:31:58 UTC+0000
0xfffffa8005259060 wininit.exe 380 324 3 78 0 0 2019-03-22 05:31:58 UTC+0000
0xfffffa8005268b30 winlogon.exe 416 364 3 110 1 0 2019-03-22 05:31:58 UTC+0000
0xfffffa8005680910 services.exe 476 380 12 224 0 0 2019-03-22 05:31:59 UTC+0000
0xfffffa80056885e0 lsass.exe 484 380 7 650 0 0 2019-03-22 05:32:00 UTC+0000
0xfffffa8005696b30 lsm.exe 492 380 10 155 0 0 2019-03-22 05:32:00 UTC+0000
0xfffffa80056e1060 svchost.exe 592 476 9 375 0 0 2019-03-22 05:32:01 UTC+0000
0xfffffa800570d060 svchost.exe 672 476 7 341 0 0 2019-03-22 05:32:02 UTC+0000
0xfffffa800575e5b0 svchost.exe 764 476 20 447 0 0 2019-03-22 05:32:02 UTC+0000
0xfffffa8005775b30 svchost.exe 796 476 15 368 0 0 2019-03-22 05:32:03 UTC+0000
0xfffffa800577db30 svchost.exe 820 476 33 1073 0 0 2019-03-22 05:32:03 UTC+0000
0xfffffa80057beb30 svchost.exe 932 476 10 568 0 0 2019-03-22 05:32:03 UTC+0000
0xfffffa80057e4560 svchost.exe 232 476 15 410 0 0 2019-03-22 05:32:03 UTC+0000
0xfffffa8005850a30 spoolsv.exe 864 476 12 279 0 0 2019-03-22 05:32:04 UTC+0000
0xfffffa800583db30 svchost.exe 1028 476 19 307 0 0 2019-03-22 05:32:05 UTC+0000
0xfffffa80058ed390 OfficeClickToR 1136 476 23 631 0 0 2019-03-22 05:32:05 UTC+0000
0xfffffa80059cb7c0 taskhost.exe 1276 476 8 183 1 0 2019-03-22 05:32:07 UTC+0000
0xfffffa80059cc620 taskeng.exe 1292 820 4 83 0 0 2019-03-22 05:32:07 UTC+0000
0xfffffa80059e6890 dwm.exe 1344 796 3 88 1 0 2019-03-22 05:32:07 UTC+0000
0xfffffa8003de39c0 explorer.exe 1432 1308 28 976 1 0 2019-03-22 05:32:07 UTC+0000
0xfffffa8005a324e0 FileZilla Serv 1476 476 9 81 0 1 2019-03-22 05:32:07 UTC+0000
0xfffffa8005af24e0 VGAuthService. 1768 476 3 89 0 0 2019-03-22 05:32:09 UTC+0000
0xfffffa8005b49890 vmtoolsd.exe 1828 1432 6 144 1 0 2019-03-22 05:32:10 UTC+0000
0xfffffa8005b4eb30 vmtoolsd.exe 1852 476 10 314 0 0 2019-03-22 05:32:11 UTC+0000
0xfffffa8005ba0620 ManagementAgen 1932 476 10 102 0 0 2019-03-22 05:32:11 UTC+0000
0xfffffa8005be12c0 FileZilla Serv 1996 1860 3 99 1 1 2019-03-22 05:32:12 UTC+0000
0xfffffa8005409060 dllhost.exe 2072 476 13 194 0 0 2019-03-22 05:32:14 UTC+0000
0xfffffa8005478060 msdtc.exe 2188 476 12 146 0 0 2019-03-22 05:32:15 UTC+0000
0xfffffa80054d2380 WmiPrvSE.exe 2196 592 11 222 0 0 2019-03-22 05:32:15 UTC+0000
0xfffffa8005508650 SearchIndexer. 2456 476 13 766 0 0 2019-03-22 05:32:17 UTC+0000
0xfffffa80055b0060 wmpnetwk.exe 2628 476 9 210 0 0 2019-03-22 05:32:18 UTC+0000
0xfffffa8005c4ab30 svchost.exe 2888 476 11 152 0 0 2019-03-22 05:32:20 UTC+0000
0xfffffa80054f9060 notepad.exe 3032 1432 1 60 1 0 2019-03-22 05:32:22 UTC+0000
0xfffffa8005c8e440 WmiPrvSE.exe 2436 592 9 245 0 0 2019-03-22 05:32:33 UTC+0000
0xfffffa80053f83e0 EXCEL.EXE 1272 1432 21 789 1 1 2019-03-22 05:33:49 UTC+0000
0xfffffa80042aa430 cmd.exe 1408 1432 1 23 1 0 2019-03-22 05:34:12 UTC+0000
0xfffffa80042ab620 conhost.exe 1008 372 2 55 1 0 2019-03-22 05:34:12 UTC+0000
0xfffffa8004300620 taskeng.exe 1156 820 4 93 1 0 2019-03-22 05:34:14 UTC+0000
0xfffffa8004330b30 sppsvc.exe 3260 476 4 149 0 0 2019-03-22 05:34:15 UTC+0000
0xfffffa800432f060 svchost.exe 3300 476 13 346 0 0 2019-03-22 05:34:15 UTC+0000
0xfffffa800474c060 OUTLOOK.EXE 3688 1432 30 2023 1 1 2019-03-22 05:34:37 UTC+0000
0xfffffa800474fb30 taskmgr.exe 3792 1432 6 134 1 0 2019-03-22 05:34:38 UTC+0000
0xfffffa8005d067d0 StikyNot.exe 1628 1432 8 183 1 0 2019-03-22 05:34:42 UTC+0000
0xfffffa8004798320 calc.exe 3548 1432 3 77 1 0 2019-03-22 05:34:43 UTC+0000
0xfffffa80047cb060 iexplore.exe 3576 592 12 403 1 1 2019-03-22 05:34:48 UTC+0000
0xfffffa80047e9540 iexplore.exe 2780 3576 6 233 1 1 2019-03-22 05:34:48 UTC+0000
0xfffffa8004905620 hfs.exe 3952 1432 6 214 1 1 2019-03-22 05:34:51 UTC+0000
0xfffffa80053d3060 POWERPNT.EXE 4048 1432 23 765 1 1 2019-03-22 05:35:09 UTC+0000
0xfffffa8004083880 FTK Imager.exe 3192 1432 6 353 1 0 2019-03-22 05:35:12 UTC+0000
0xfffffa80042dbb30 chrome.exe 3248 1432 32 841 1 0 2019-03-22 05:35:14 UTC+0000
0xfffffa80047beb30 chrome.exe 3244 3248 7 91 1 0 2019-03-22 05:35:15 UTC+0000
0xfffffa80052f0060 chrome.exe 2100 3248 2 59 1 0 2019-03-22 05:35:15 UTC+0000
0xfffffa80053306f0 chrome.exe 1816 3248 14 328 1 0 2019-03-22 05:35:16 UTC+0000
0xfffffa8005300b30 chrome.exe 4156 3248 14 216 1 0 2019-03-22 05:35:17 UTC+0000
0xfffffa8005442b30 chrome.exe 4232 3248 14 233 1 0 2019-03-22 05:35:17 UTC+0000
0xfffffa8005419b30 chrome.exe 4240 3248 14 215 1 0 2019-03-22 05:35:17 UTC+0000
0xfffffa800540db30 chrome.exe 4520 3248 10 234 1 0 2019-03-22 05:35:18 UTC+0000
0xfffffa80053cbb30 chrome.exe 4688 3248 13 168 1 0 2019-03-22 05:35:19 UTC+0000
0xfffffa8005a80060 wscript.exe 5116 3952 8 312 1 1 2019-03-22 05:35:32 UTC+0000
0xfffffa8005a1d9e0 UWkpjFjDzM.exe 3496 5116 5 109 1 1 2019-03-22 05:35:33 UTC+0000
0xfffffa8005bb0060 cmd.exe 4660 3496 1 33 1 1 2019-03-22 05:35:36 UTC+0000
0xfffffa8005c1ab30 conhost.exe 4656 372 2 49 1 0 2019-03-22 05:35:36 UTC+0000 #4 Respuesta: UWkpjFjDzM.exe
Name the child process of wscript.exe.
Obtención de la evidencia
Para poder sacar el árbol de procesos Volatility cuenta con la opción pstree
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 pstree
Volatility Foundation Volatility Framework 2.6.1
Name Pid PPid Thds Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
0xfffffa8003de39c0:explorer.exe 1432 1308 28 976 2019-03-22 05:32:07 UTC+0000
. 0xfffffa80042aa430:cmd.exe 1408 1432 1 23 2019-03-22 05:34:12 UTC+0000
. 0xfffffa8005d067d0:StikyNot.exe 1628 1432 8 183 2019-03-22 05:34:42 UTC+0000
. 0xfffffa80042dbb30:chrome.exe 3248 1432 32 841 2019-03-22 05:35:14 UTC+0000
.. 0xfffffa8005442b30:chrome.exe 4232 3248 14 233 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa80047beb30:chrome.exe 3244 3248 7 91 2019-03-22 05:35:15 UTC+0000
.. 0xfffffa80053306f0:chrome.exe 1816 3248 14 328 2019-03-22 05:35:16 UTC+0000
.. 0xfffffa8005300b30:chrome.exe 4156 3248 14 216 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa8005419b30:chrome.exe 4240 3248 14 215 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa800540db30:chrome.exe 4520 3248 10 234 2019-03-22 05:35:18 UTC+0000
.. 0xfffffa80052f0060:chrome.exe 2100 3248 2 59 2019-03-22 05:35:15 UTC+0000
.. 0xfffffa80053cbb30:chrome.exe 4688 3248 13 168 2019-03-22 05:35:19 UTC+0000
. 0xfffffa800474c060:OUTLOOK.EXE 3688 1432 30 2023 2019-03-22 05:34:37 UTC+0000
. 0xfffffa8004798320:calc.exe 3548 1432 3 77 2019-03-22 05:34:43 UTC+0000
. 0xfffffa80053d3060:POWERPNT.EXE 4048 1432 23 765 2019-03-22 05:35:09 UTC+0000
. 0xfffffa8004905620:hfs.exe 3952 1432 6 214 2019-03-22 05:34:51 UTC+0000
.. 0xfffffa8005a80060:wscript.exe 5116 3952 8 312 2019-03-22 05:35:32 UTC+0000
... 0xfffffa8005a1d9e0:UWkpjFjDzM.exe 3496 5116 5 109 2019-03-22 05:35:33 UTC+0000
.... 0xfffffa8005bb0060:cmd.exe 4660 3496 1 33 2019-03-22 05:35:36 UTC+0000
. 0xfffffa80054f9060:notepad.exe 3032 1432 1 60 2019-03-22 05:32:22 UTC+0000
. 0xfffffa8005b49890:vmtoolsd.exe 1828 1432 6 144 2019-03-22 05:32:10 UTC+0000
. 0xfffffa800474fb30:taskmgr.exe 3792 1432 6 134 2019-03-22 05:34:38 UTC+0000
. 0xfffffa80053f83e0:EXCEL.EXE 1272 1432 21 789 2019-03-22 05:33:49 UTC+0000
. 0xfffffa8004083880:FTK Imager.exe 3192 1432 6 353 2019-03-22 05:35:12 UTC+0000
0xfffffa8003c72b30:System 4 0 87 547 2019-03-22 05:31:55 UTC+0000
. 0xfffffa8004616040:smss.exe 252 4 2 30 2019-03-22 05:31:55 UTC+0000
0xfffffa80050546b0:csrss.exe 332 324 10 516 2019-03-22 05:31:58 UTC+0000
0xfffffa8005259060:wininit.exe 380 324 3 78 2019-03-22 05:31:58 UTC+0000
. 0xfffffa8005680910:services.exe 476 380 12 224 2019-03-22 05:31:59 UTC+0000
.. 0xfffffa8005409060:dllhost.exe 2072 476 13 194 2019-03-22 05:32:14 UTC+0000
.. 0xfffffa80055b0060:wmpnetwk.exe 2628 476 9 210 2019-03-22 05:32:18 UTC+0000
.. 0xfffffa800583db30:svchost.exe 1028 476 19 307 2019-03-22 05:32:05 UTC+0000
.. 0xfffffa8005775b30:svchost.exe 796 476 15 368 2019-03-22 05:32:03 UTC+0000
... 0xfffffa80059e6890:dwm.exe 1344 796 3 88 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005508650:SearchIndexer. 2456 476 13 766 2019-03-22 05:32:17 UTC+0000
.. 0xfffffa80057beb30:svchost.exe 932 476 10 568 2019-03-22 05:32:03 UTC+0000
.. 0xfffffa800432f060:svchost.exe 3300 476 13 346 2019-03-22 05:34:15 UTC+0000
.. 0xfffffa8005478060:msdtc.exe 2188 476 12 146 2019-03-22 05:32:15 UTC+0000
.. 0xfffffa800577db30:svchost.exe 820 476 33 1073 2019-03-22 05:32:03 UTC+0000
... 0xfffffa80059cc620:taskeng.exe 1292 820 4 83 2019-03-22 05:32:07 UTC+0000
... 0xfffffa8004300620:taskeng.exe 1156 820 4 93 2019-03-22 05:34:14 UTC+0000
.. 0xfffffa80059cb7c0:taskhost.exe 1276 476 8 183 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005b4eb30:vmtoolsd.exe 1852 476 10 314 2019-03-22 05:32:11 UTC+0000
.. 0xfffffa800570d060:svchost.exe 672 476 7 341 2019-03-22 05:32:02 UTC+0000
.. 0xfffffa8005a324e0:FileZilla Serv 1476 476 9 81 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005c4ab30:svchost.exe 2888 476 11 152 2019-03-22 05:32:20 UTC+0000
.. 0xfffffa8005ba0620:ManagementAgen 1932 476 10 102 2019-03-22 05:32:11 UTC+0000
.. 0xfffffa80056e1060:svchost.exe 592 476 9 375 2019-03-22 05:32:01 UTC+0000
... 0xfffffa80054d2380:WmiPrvSE.exe 2196 592 11 222 2019-03-22 05:32:15 UTC+0000
... 0xfffffa8005c8e440:WmiPrvSE.exe 2436 592 9 245 2019-03-22 05:32:33 UTC+0000
... 0xfffffa80047cb060:iexplore.exe 3576 592 12 403 2019-03-22 05:34:48 UTC+0000
.... 0xfffffa80047e9540:iexplore.exe 2780 3576 6 233 2019-03-22 05:34:48 UTC+0000
.. 0xfffffa8005850a30:spoolsv.exe 864 476 12 279 2019-03-22 05:32:04 UTC+0000
.. 0xfffffa80057e4560:svchost.exe 232 476 15 410 2019-03-22 05:32:03 UTC+0000
.. 0xfffffa80058ed390:OfficeClickToR 1136 476 23 631 2019-03-22 05:32:05 UTC+0000
.. 0xfffffa8005af24e0:VGAuthService. 1768 476 3 89 2019-03-22 05:32:09 UTC+0000
.. 0xfffffa8004330b30:sppsvc.exe 3260 476 4 149 2019-03-22 05:34:15 UTC+0000
.. 0xfffffa800575e5b0:svchost.exe 764 476 20 447 2019-03-22 05:32:02 UTC+0000
. 0xfffffa80056885e0:lsass.exe 484 380 7 650 2019-03-22 05:32:00 UTC+0000
. 0xfffffa8005696b30:lsm.exe 492 380 10 155 2019-03-22 05:32:00 UTC+0000
0xfffffa8005268b30:winlogon.exe 416 364 3 110 2019-03-22 05:31:58 UTC+0000
0xfffffa800525a9e0:csrss.exe 372 364 11 557 2019-03-22 05:31:58 UTC+0000
. 0xfffffa80042ab620:conhost.exe 1008 372 2 55 2019-03-22 05:34:12 UTC+0000
. 0xfffffa8005c1ab30:conhost.exe 4656 372 2 49 2019-03-22 05:35:36 UTC+0000
0xfffffa8005be12c0:FileZilla Serv 1996 1860 3 99 2019-03-22 05:32:12 UTC+0000
#5 Respuesta: 10.0.0.10
What was the IP address of the machine at the time the RAM dump was created?
Obtención de la evidencia
Una de las opciones con la que podemos sacar esta información es con netscan
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan
Volatility Foundation Volatility Framework 2.6.1
Offset(P) Proto Local Address Foreign Address State Pid Owner Created
0x13e057300 UDPv4 10.0.0.101:55736 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e05b4f0 UDPv6 ::1:55735 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e05b790 UDPv6 fe80::7475:ef30:be18:7807:55734 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e05d4b0 UDPv6 fe80::7475:ef30:be18:7807:1900 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e05dec0 UDPv4 127.0.0.1:55737 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e05e3f0 UDPv4 10.0.0.101:1900 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e05eab0 UDPv6 ::1:1900 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e064d70 UDPv4 127.0.0.1:1900 *:* 2888 svchost.exe 2019-03-22 05:32:20 UTC+0000
0x13e02bcf0 TCPv4 -:49220 72.51.60.132:443 CLOSED 4048 POWERPNT.EXE
0x13e035790 TCPv4 -:49223 72.51.60.132:443 CLOSED 4048 POWERPNT.EXE
0x13e036470 TCPv4 -:49224 72.51.60.132:443 CLOSED 4048 POWERPNT.EXE
0x13e258010 UDPv4 127.0.0.1:55560 *:* 5116 wscript.exe 2019-03-22 05:35:32 UTC+0000
0x13e305a50 UDPv4 0.0.0.0:5355 *:* 232 svchost.exe 2019-03-22 05:32:09 UTC+0000
0x13e360be0 UDPv4 0.0.0.0:63790 *:* 504 2019-03-22 05:45:47 UTC+0000
0x13e490ec0 UDPv4 0.0.0.0:5355 *:* 232 svchost.exe 2019-03-22 05:32:09 UTC+0000
0x13e490ec0 UDPv6 :::5355 *:* 232 svchost.exe 2019-03-22 05:32:09 UTC+0000
0x13e5683e0 UDPv4 10.0.0.101:137 *:* 4 System 2019-03-22 05:32:06 UTC+0000
0x13e594250 UDPv4 10.0.0.101:138 *:* 4 System 2019-03-22 05:32:06 UTC+0000
0x13e597ec0 UDPv4 0.0.0.0:0 *:* 232 svchost.exe 2019-03-22 05:32:06 UTC+0000
0x13e597ec0 UDPv6 :::0 *:* 232 svchost.exe 2019-03-22 05:32:06 UTC+0000
0x13e61fb30 UDPv6 fe80::7475:ef30:be18:7807:546 *:* 764 svchost.exe 2019-03-22 05:46:23 UTC+0000
0x13e918010 UDPv4 0.0.0.0:56372 *:* 1816 chrome.exe 2019-03-22 05:45:51 UTC+0000
0x13e9cd730 UDPv4 127.0.0.1:57374 *:* 1136 OfficeClickToR 2019-03-22 05:32:18 UTC+0000
0x13ea8e6a0 UDPv4 127.0.0.1:61704 *:* 3688 OUTLOOK.EXE 2019-03-22 05:34:44 UTC+0000
0x13ead0bf0 UDPv4 127.0.0.1:55614 *:* 4048 POWERPNT.EXE 2019-03-22 05:35:15 UTC+0000
0x13ebc6c20 UDPv4 0.0.0.0:5353 *:* 3248 chrome.exe 2019-03-22 05:35:17 UTC+0000
0x13ebea890 UDPv4 0.0.0.0:5353 *:* 3248 chrome.exe 2019-03-22 05:35:17 UTC+0000
0x13ebea890 UDPv6 :::5353 *:* 3248 chrome.exe 2019-03-22 05:35:17 UTC+0000
0x13e2c6b10 TCPv4 0.0.0.0:21 0.0.0.0:0 LISTENING 1476 FileZilla Serv
0x13e2c6b10 TCPv6 :::21 :::0 LISTENING 1476 FileZilla Serv
0x13e2c7850 TCPv6 ::1:14147 :::0 LISTENING 1476 FileZilla Serv
0x13e2c96b0 TCPv4 127.0.0.1:14147 0.0.0.0:0 LISTENING 1476 FileZilla Serv
0x13e2c9be0 TCPv4 0.0.0.0:21 0.0.0.0:0 LISTENING 1476 FileZilla Serv
0x13e3a1150 TCPv4 0.0.0.0:49155 0.0.0.0:0 LISTENING 484 lsass.exe
0x13e3a1150 TCPv6 :::49155 :::0 LISTENING 484 lsass.exe
0x13e3b2010 TCPv4 0.0.0.0:49155 0.0.0.0:0 LISTENING 484 lsass.exe
0x13e430580 TCPv4 0.0.0.0:49154 0.0.0.0:0 LISTENING 820 svchost.exe
0x13e430580 TCPv6 :::49154 :::0 LISTENING 820 svchost.exe
0x13e431820 TCPv4 0.0.0.0:49154 0.0.0.0:0 LISTENING 820 svchost.exe
0x13e57e010 TCPv4 10.0.0.101:139 0.0.0.0:0 LISTENING 4 System
0x13e71cef0 TCPv4 0.0.0.0:135 0.0.0.0:0 LISTENING 672 svchost.exe
0x13e720660 TCPv4 0.0.0.0:135 0.0.0.0:0 LISTENING 672 svchost.exe
0x13e720660 TCPv6 :::135 :::0 LISTENING 672 svchost.exe
0x13e72f010 TCPv4 0.0.0.0:49152 0.0.0.0:0 LISTENING 380 wininit.exe
0x13e72f6e0 TCPv4 0.0.0.0:49152 0.0.0.0:0 LISTENING 380 wininit.exe
0x13e72f6e0 TCPv6 :::49152 :::0 LISTENING 380 wininit.exe
0x13e770240 TCPv4 0.0.0.0:49153 0.0.0.0:0 LISTENING 764 svchost.exe
0x13e772980 TCPv4 0.0.0.0:49153 0.0.0.0:0 LISTENING 764 svchost.exe
0x13e772980 TCPv6 :::49153 :::0 LISTENING 764 svchost.exe
0x13ebb3010 TCPv4 0.0.0.0:49156 0.0.0.0:0 LISTENING 476 services.exe
0x13ebb3010 TCPv6 :::49156 :::0 LISTENING 476 services.exe
0x13ebcdef0 TCPv4 0.0.0.0:80 0.0.0.0:0 LISTENING 3952 hfs.exe
0x13e2348a0 TCPv4 -:49366 192.168.206.181:389 CLOSED 504
0x13e397190 TCPv4 10.0.0.101:49217 10.0.0.106:4444 ESTABLISHED 3496 UWkpjFjDzM.exe
0x13e3986d0 TCPv4 -:49378 213.209.1.129:25 CLOSED 504
0x13e3abae0 TCPv4 -:49226 72.51.60.132:443 CLOSED 4048 POWERPNT.EXE
0x13e3e7010 TCPv6 -:0 38db:7705:80fa:ffff:38db:7705:80fa:ffff:0 CLOSED 1136 OfficeClickToR
0x13e441830 TCPv6 -:0 382b:c703:80fa:ffff:382b:c703:80fa:ffff:0 CLOSED 1 ?RK????
0x13e4e4910 TCPv4 10.0.0.101:49208 52.109.12.6:443 CLOSED 504
0x13e55fae0 TCPv4 10.0.0.101:49209 52.96.44.162:443 CLOSED 504
0x13e71b540 TCPv4 -:0 104.208.112.5:0 CLOSED 1 ?RK????
0x13e73b560 TCPv4 -:49266 35.190.69.156:443 CLOSED 504
0x13e7c6010 TCPv4 10.0.0.101:49204 172.217.6.195:443 CLOSED 1816 chrome.exe
0x13ead7cf0 TCPv4 10.0.0.101:49202 172.217.10.68:443 CLOSED 1816 chrome.exe
0x13f5898a0 TCPv4 0.0.0.0:49156 0.0.0.0:0 LISTENING 476 services.exe
0x13f5899c0 TCPv4 0.0.0.0:445 0.0.0.0:0 LISTENING 4 System
0x13f5899c0 TCPv6 :::445 :::0 LISTENING 4 System
0x13f4facf0 TCPv4 10.0.0.101:49262 52.109.12.6:443 ESTABLISHED 3688 OUTLOOK.EXE
0x13f50a010 TCPv4 -:49265 213.186.33.3:443 CLOSED 504
0x13f5289f0 TCPv4 -:49234 72.51.60.133:80 CLOSED 3688 OUTLOOK.EXE
0x13f7b4ec0 UDPv4 0.0.0.0:55707 *:* 232 svchost.exe 2019-03-22 05:45:44 UTC+0000
0x13f7e8670 UDPv4 127.0.0.1:59411 *:* 3576 iexplore.exe 2019-03-22 05:34:49 UTC+0000
0x13fc6f1b0 UDPv4 0.0.0.0:55102 *:* 232 svchost.exe 2019-03-22 05:45:36 UTC+0000
0x13fc78dc0 UDPv4 127.0.0.1:53361 *:* 1272 EXCEL.EXE 2019-03-22 05:34:03 UTC+0000
0x13f7ae010 TCPv4 10.0.0.101:49263 52.96.44.162:443 ESTABLISHED 3688 OUTLOOK.EXE
0x13fa93cf0 TCPv4 -:49173 72.51.60.132:443 CLOSED 1272 EXCEL.EXE
0x13fa95cf0 TCPv4 -:49170 72.51.60.132:443 CLOSED 1272 EXCEL.EXE
0x13fa969f0 TCPv4 -:0 56.219.119.5:0 CLOSED 1272 EXCEL.EXE
0x13fbd07e0 TCPv4 -:49372 212.227.15.9:25 CLOSED 504
0x13fc857e0 TCPv4 -:49167 72.51.60.132:443 CLOSED 1272 EXCEL.EXE #6 Respuesta: 10.0.0.106
Based on the answer regarding the infected PID, can you determine the IP of the attacker?
Obtención de la evidencia
De la misma forma que en la pregunta #5 empleamos la opción netscan y filtramos por el nombre del fichero
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan | grep UWkpjFjDzM.exe
Volatility Foundation Volatility Framework 2.6.1
0x13e397190 TCPv4 10.0.0.101:49217 10.0.0.106:4444 ESTABLISHED 3496 UWkpjFjDzM.exe
#Respuesta: 6
How many processes are associated with VCRUNTIME140.dll?
Obtención de la evidencia
Mediante dlllist listamos todas las DLL.
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 dlllist | grep VCRUNTIME140.dll
Volatility Foundation Volatility Framework 2.6.1
0x000007fefa5c0000 0x16000 0xffff 2019-03-22 05:32:05 UTC+0000 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll
0x00000000745f0000 0x15000 0xffff 2019-03-22 05:33:49 UTC+0000 C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000 0x15000 0xffff 2019-03-22 05:34:37 UTC+0000 C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000 0x15000 0x3 2019-03-22 05:34:49 UTC+0000 C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000 0x15000 0xffff 2019-03-22 05:35:09 UTC+0000 C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dllMas información
#8 Respuesta: 690ea20bc3bdfb328e23005d9a80c290
After dumping the infected process, what is its md5 hash?
Obtención de la evidencia
Mediante procdump descargamos el malware
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 procdump -D malware/ -p 3496
Volatility Foundation Volatility Framework 2.6.1
Process(V) ImageBase Name Result
------------------ ------------------ -------------------- ------
0xfffffa8005a1d9e0 0x0000000000400000 UWkpjFjDzM.exe OK: executable.3496.exeUna vez descargado comprobamos el hash
md5sum malware/executable.3496.exe
690ea20bc3bdfb328e23005d9a80c290 malware/executable.3496.exe#9 Respuesta: aad3b435b51404eeaad3b435b51404ee
What is the LM hash of Bob's account?
Obtención de la evidencia
Realizamos un Dump de todos los hash con la opción hashdump
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 hashdump
Volatility Foundation Volatility Framework 2.6.1
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Bob:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Mas información
#10 Respuesta: PAGE_READONLY
What memory protection constants does the VAD node at 0xfffffa800577ba10 have?
Obtención de la evidencia
Mediante la utilidad vainfo listamos y grepeamos por la dirección 0xfffffa800577ba10
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 vadinfo | grep -A 3 0xfffffa800577ba10
Volatility Foundation Volatility Framework 2.6.1
VAD node @ 0xfffffa800577ba10 Start 0x0000000000030000 End 0x0000000000033fff Tag Vad
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
Vad Type: VadNone
#11 Respuesta: PAGE_NOACCESS
What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?
Obtención de la evidencia
De la misma forma que en la pregunta #10 empleamos vainfo y grepeamos por «Start 0x00000000033c0000 End 0x00000000033dffff
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 vadinfo | grep -A 3 "Start 0x00000000033c0000 End 0x00000000033dffff"
Volatility Foundation Volatility Framework 2.6.1
VAD node @ 0xfffffa80052652b0 Start 0x00000000033c0000 End 0x00000000033dffff Tag VadS
Flags: CommitCharge: 32, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS
Vad Type: VadNone
12 Respuesta: vhjReUDEuumr
There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)
Obtención de la evidencia
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 cmdline | grep vbs
Volatility Foundation Volatility Framework 2.6.1
Command line : "C:\Windows\System32\wscript.exe" //B //NOLOGO %TEMP%\vhjReUDEuumrX.vbsMas información
#13 Respuesta: Skype.exe
An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)
Obtención de la evidencia
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 shimcache | grep "2019-03-07 23:06:58"
Volatility Foundation Volatility Framework 2.6.1
2019-03-07 23:06:58 UTC+0000 \??\C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exeMas información
Amcache and Shimcache in forensic analysis
Volatility, my own cheatsheet (Part 6): Windows Registry
14 Respuesta: flag<REDBULL_IS_LIFE>
What was written in notepad.exe at the time when the memory dump was captured?
Obtención de la evidencia
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 memdump --dump-dir=./notepad/ -p 3032
Volatility Foundation Volatility Framework 2.6.1
************************************************************************
Writing notepad.exe [ 3032] to 3032.dmp
Filtramos los strings empleando «flag<«
strings -e l notepad/3032.dmp | grep "flag<"
flag<REDBULL_IS_LIFE>
flag<Th>
flag<Th>
flag<TheK>
flag<TheK>
Mas información
- Volatility, my own cheatsheet (Part 3): Process Memory
- Volatility tips: how to extract text typed in a notepad window from a Windows memory dump
#15 Respuesta:
What is the short name of the file at file record 59045?
Obtención de la evidencia
Volcamos toda la tabla MFT
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 mftparser > Documents/59045.txt
Volatility Foundation Volatility Framework 2.6.1
Buscamos por 59045
MFT entry found at offset 0x2193d400
Attribute: In Use & File
Record Number: 59045
Link count: 2
$STANDARD_INFORMATION
Creation Modified MFT Altered Access Date Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000 2019-03-17 07:04:43 UTC+0000 2019-03-17 07:04:42 UTC+0000 Archive
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000 2019-03-17 07:04:43 UTC+0000 2019-03-17 07:04:42 UTC+0000 Users\Bob\DOCUME~1\EMPLOY~1\EMPLOY~1.XLS
$FILE_NAME
Creation Modified MFT Altered Access Date Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000 2019-03-17 07:04:43 UTC+0000 2019-03-17 07:04:42 UTC+0000 Users\Bob\DOCUME~1\EMPLOY~1\EmployeeInformation.xlsxMas información
- How to extract data and timeline from Master File Table on NTFS filesystem
- Forensic : Extracting files from MFT Table with Volatility (Part 2) [EN]
- Volatility, my own cheatsheet (Part 8): Filesystem
#16 Respuesta: 3496
This box was exploited and is running meterpreter. What was the infected PID
Empleando la utilidad netscan vemos todas las conexiones abiertas, filtramos por el proceso (UWkpjFjDzM.exe) el cual ya lo vimos en la pregunta #6
Como podemos observar tenemos una conexión establecida por el puerto 4444 y el PID 3496
vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan | grep UWkpjFjDzM.exe
Volatility Foundation Volatility Framework 2.6.1
0x13e397190 TCPv4 10.0.0.101:49217 10.0.0.106:4444 ESTABLISHED 3496 UWkpjFjDzM.exe :wq!