Cyberdefenders – DumpMe writeup

Scenario:

One of the SOC analysts took a memory dump from a machine infected with a meterpreter malware. As a Digital Forensicators, your job is to analyze the dump, extract the available indicators of compromise (IOCs) and answer the provided questions.

Tools:

  1. Volatility 2

#1 Respuesta: c95e8cc8c946f95a109ea8e47a6800de10a27abd

What is the SHA1 hash of triage.mem (memory dump)?

Obtención de la evidencia

sha1sum Triage-Memory.mem 
c95e8cc8c946f95a109ea8e47a6800de10a27abd  Triage-Memory.mem

#2 Respuesta: Win7SP1x64

What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)

Obtención de la evidencia

esta información que nos piden lo podemos sacar mediante kdbgscan o imageinfo

vol.py -f Triage-Memory.mem imageinfo
Volatility Foundation Volatility Framework 2.6.1
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418
                     AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (/opt/cyberdefense/DumpMe/Triage-Memory.mem)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf800029f80a0L
          Number of Processors : 2
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff800029f9d00L
                KPCR for CPU 1 : 0xfffff880009ee000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2019-03-22 05:46:00 UTC+0000
     Image local date and time : 2019-03-22 01:46:00 -0400

#3 Respuesta: 3032

What was the process ID of notepad.exe?

Obtención de la evidencia

El listado de todos los procesos lo podemos sacar mediante: pslist

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 pslist
Volatility Foundation Volatility Framework 2.6.1
Offset(V)          Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit                          
------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0xfffffa8003c72b30 System                    4      0     87      547 ------      0 2019-03-22 05:31:55 UTC+0000                                 
0xfffffa8004616040 smss.exe                252      4      2       30 ------      0 2019-03-22 05:31:55 UTC+0000                                 
0xfffffa80050546b0 csrss.exe               332    324     10      516      0      0 2019-03-22 05:31:58 UTC+0000                                 
0xfffffa800525a9e0 csrss.exe               372    364     11      557      1      0 2019-03-22 05:31:58 UTC+0000                                 
0xfffffa8005259060 wininit.exe             380    324      3       78      0      0 2019-03-22 05:31:58 UTC+0000                                 
0xfffffa8005268b30 winlogon.exe            416    364      3      110      1      0 2019-03-22 05:31:58 UTC+0000                                 
0xfffffa8005680910 services.exe            476    380     12      224      0      0 2019-03-22 05:31:59 UTC+0000                                 
0xfffffa80056885e0 lsass.exe               484    380      7      650      0      0 2019-03-22 05:32:00 UTC+0000                                 
0xfffffa8005696b30 lsm.exe                 492    380     10      155      0      0 2019-03-22 05:32:00 UTC+0000                                 
0xfffffa80056e1060 svchost.exe             592    476      9      375      0      0 2019-03-22 05:32:01 UTC+0000                                 
0xfffffa800570d060 svchost.exe             672    476      7      341      0      0 2019-03-22 05:32:02 UTC+0000                                 
0xfffffa800575e5b0 svchost.exe             764    476     20      447      0      0 2019-03-22 05:32:02 UTC+0000                                 
0xfffffa8005775b30 svchost.exe             796    476     15      368      0      0 2019-03-22 05:32:03 UTC+0000                                 
0xfffffa800577db30 svchost.exe             820    476     33     1073      0      0 2019-03-22 05:32:03 UTC+0000                                 
0xfffffa80057beb30 svchost.exe             932    476     10      568      0      0 2019-03-22 05:32:03 UTC+0000                                 
0xfffffa80057e4560 svchost.exe             232    476     15      410      0      0 2019-03-22 05:32:03 UTC+0000                                 
0xfffffa8005850a30 spoolsv.exe             864    476     12      279      0      0 2019-03-22 05:32:04 UTC+0000                                 
0xfffffa800583db30 svchost.exe            1028    476     19      307      0      0 2019-03-22 05:32:05 UTC+0000                                 
0xfffffa80058ed390 OfficeClickToR         1136    476     23      631      0      0 2019-03-22 05:32:05 UTC+0000                                 
0xfffffa80059cb7c0 taskhost.exe           1276    476      8      183      1      0 2019-03-22 05:32:07 UTC+0000                                 
0xfffffa80059cc620 taskeng.exe            1292    820      4       83      0      0 2019-03-22 05:32:07 UTC+0000                                 
0xfffffa80059e6890 dwm.exe                1344    796      3       88      1      0 2019-03-22 05:32:07 UTC+0000                                 
0xfffffa8003de39c0 explorer.exe           1432   1308     28      976      1      0 2019-03-22 05:32:07 UTC+0000                                 
0xfffffa8005a324e0 FileZilla Serv         1476    476      9       81      0      1 2019-03-22 05:32:07 UTC+0000                                 
0xfffffa8005af24e0 VGAuthService.         1768    476      3       89      0      0 2019-03-22 05:32:09 UTC+0000                                 
0xfffffa8005b49890 vmtoolsd.exe           1828   1432      6      144      1      0 2019-03-22 05:32:10 UTC+0000                                 
0xfffffa8005b4eb30 vmtoolsd.exe           1852    476     10      314      0      0 2019-03-22 05:32:11 UTC+0000                                 
0xfffffa8005ba0620 ManagementAgen         1932    476     10      102      0      0 2019-03-22 05:32:11 UTC+0000                                 
0xfffffa8005be12c0 FileZilla Serv         1996   1860      3       99      1      1 2019-03-22 05:32:12 UTC+0000                                 
0xfffffa8005409060 dllhost.exe            2072    476     13      194      0      0 2019-03-22 05:32:14 UTC+0000                                 
0xfffffa8005478060 msdtc.exe              2188    476     12      146      0      0 2019-03-22 05:32:15 UTC+0000                                 
0xfffffa80054d2380 WmiPrvSE.exe           2196    592     11      222      0      0 2019-03-22 05:32:15 UTC+0000                                 
0xfffffa8005508650 SearchIndexer.         2456    476     13      766      0      0 2019-03-22 05:32:17 UTC+0000                                 
0xfffffa80055b0060 wmpnetwk.exe           2628    476      9      210      0      0 2019-03-22 05:32:18 UTC+0000                                 
0xfffffa8005c4ab30 svchost.exe            2888    476     11      152      0      0 2019-03-22 05:32:20 UTC+0000                                 
0xfffffa80054f9060 notepad.exe            3032   1432      1       60      1      0 2019-03-22 05:32:22 UTC+0000                                 
0xfffffa8005c8e440 WmiPrvSE.exe           2436    592      9      245      0      0 2019-03-22 05:32:33 UTC+0000                                 
0xfffffa80053f83e0 EXCEL.EXE              1272   1432     21      789      1      1 2019-03-22 05:33:49 UTC+0000                                 
0xfffffa80042aa430 cmd.exe                1408   1432      1       23      1      0 2019-03-22 05:34:12 UTC+0000                                 
0xfffffa80042ab620 conhost.exe            1008    372      2       55      1      0 2019-03-22 05:34:12 UTC+0000                                 
0xfffffa8004300620 taskeng.exe            1156    820      4       93      1      0 2019-03-22 05:34:14 UTC+0000                                 
0xfffffa8004330b30 sppsvc.exe             3260    476      4      149      0      0 2019-03-22 05:34:15 UTC+0000                                 
0xfffffa800432f060 svchost.exe            3300    476     13      346      0      0 2019-03-22 05:34:15 UTC+0000                                 
0xfffffa800474c060 OUTLOOK.EXE            3688   1432     30     2023      1      1 2019-03-22 05:34:37 UTC+0000                                 
0xfffffa800474fb30 taskmgr.exe            3792   1432      6      134      1      0 2019-03-22 05:34:38 UTC+0000                                 
0xfffffa8005d067d0 StikyNot.exe           1628   1432      8      183      1      0 2019-03-22 05:34:42 UTC+0000                                 
0xfffffa8004798320 calc.exe               3548   1432      3       77      1      0 2019-03-22 05:34:43 UTC+0000                                 
0xfffffa80047cb060 iexplore.exe           3576    592     12      403      1      1 2019-03-22 05:34:48 UTC+0000                                 
0xfffffa80047e9540 iexplore.exe           2780   3576      6      233      1      1 2019-03-22 05:34:48 UTC+0000                                 
0xfffffa8004905620 hfs.exe                3952   1432      6      214      1      1 2019-03-22 05:34:51 UTC+0000                                 
0xfffffa80053d3060 POWERPNT.EXE           4048   1432     23      765      1      1 2019-03-22 05:35:09 UTC+0000                                 
0xfffffa8004083880 FTK Imager.exe         3192   1432      6      353      1      0 2019-03-22 05:35:12 UTC+0000                                 
0xfffffa80042dbb30 chrome.exe             3248   1432     32      841      1      0 2019-03-22 05:35:14 UTC+0000                                 
0xfffffa80047beb30 chrome.exe             3244   3248      7       91      1      0 2019-03-22 05:35:15 UTC+0000                                 
0xfffffa80052f0060 chrome.exe             2100   3248      2       59      1      0 2019-03-22 05:35:15 UTC+0000                                 
0xfffffa80053306f0 chrome.exe             1816   3248     14      328      1      0 2019-03-22 05:35:16 UTC+0000                                 
0xfffffa8005300b30 chrome.exe             4156   3248     14      216      1      0 2019-03-22 05:35:17 UTC+0000                                 
0xfffffa8005442b30 chrome.exe             4232   3248     14      233      1      0 2019-03-22 05:35:17 UTC+0000                                 
0xfffffa8005419b30 chrome.exe             4240   3248     14      215      1      0 2019-03-22 05:35:17 UTC+0000                                 
0xfffffa800540db30 chrome.exe             4520   3248     10      234      1      0 2019-03-22 05:35:18 UTC+0000                                 
0xfffffa80053cbb30 chrome.exe             4688   3248     13      168      1      0 2019-03-22 05:35:19 UTC+0000                                 
0xfffffa8005a80060 wscript.exe            5116   3952      8      312      1      1 2019-03-22 05:35:32 UTC+0000                                 
0xfffffa8005a1d9e0 UWkpjFjDzM.exe         3496   5116      5      109      1      1 2019-03-22 05:35:33 UTC+0000                                 
0xfffffa8005bb0060 cmd.exe                4660   3496      1       33      1      1 2019-03-22 05:35:36 UTC+0000                                 
0xfffffa8005c1ab30 conhost.exe            4656    372      2       49      1      0 2019-03-22 05:35:36 UTC+0000       

#4 Respuesta: UWkpjFjDzM.exe

Name the child process of wscript.exe.

Obtención de la evidencia

Para poder sacar el árbol de procesos Volatility cuenta con la opción pstree

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 pstree
Volatility Foundation Volatility Framework 2.6.1
Name                                                  Pid   PPid   Thds   Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
 0xfffffa8003de39c0:explorer.exe                     1432   1308     28    976 2019-03-22 05:32:07 UTC+0000
. 0xfffffa80042aa430:cmd.exe                         1408   1432      1     23 2019-03-22 05:34:12 UTC+0000
. 0xfffffa8005d067d0:StikyNot.exe                    1628   1432      8    183 2019-03-22 05:34:42 UTC+0000
. 0xfffffa80042dbb30:chrome.exe                      3248   1432     32    841 2019-03-22 05:35:14 UTC+0000
.. 0xfffffa8005442b30:chrome.exe                     4232   3248     14    233 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa80047beb30:chrome.exe                     3244   3248      7     91 2019-03-22 05:35:15 UTC+0000
.. 0xfffffa80053306f0:chrome.exe                     1816   3248     14    328 2019-03-22 05:35:16 UTC+0000
.. 0xfffffa8005300b30:chrome.exe                     4156   3248     14    216 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa8005419b30:chrome.exe                     4240   3248     14    215 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa800540db30:chrome.exe                     4520   3248     10    234 2019-03-22 05:35:18 UTC+0000
.. 0xfffffa80052f0060:chrome.exe                     2100   3248      2     59 2019-03-22 05:35:15 UTC+0000
.. 0xfffffa80053cbb30:chrome.exe                     4688   3248     13    168 2019-03-22 05:35:19 UTC+0000
. 0xfffffa800474c060:OUTLOOK.EXE                     3688   1432     30   2023 2019-03-22 05:34:37 UTC+0000
. 0xfffffa8004798320:calc.exe                        3548   1432      3     77 2019-03-22 05:34:43 UTC+0000
. 0xfffffa80053d3060:POWERPNT.EXE                    4048   1432     23    765 2019-03-22 05:35:09 UTC+0000
. 0xfffffa8004905620:hfs.exe                         3952   1432      6    214 2019-03-22 05:34:51 UTC+0000
.. 0xfffffa8005a80060:wscript.exe                    5116   3952      8    312 2019-03-22 05:35:32 UTC+0000
... 0xfffffa8005a1d9e0:UWkpjFjDzM.exe                3496   5116      5    109 2019-03-22 05:35:33 UTC+0000
.... 0xfffffa8005bb0060:cmd.exe                      4660   3496      1     33 2019-03-22 05:35:36 UTC+0000
. 0xfffffa80054f9060:notepad.exe                     3032   1432      1     60 2019-03-22 05:32:22 UTC+0000
. 0xfffffa8005b49890:vmtoolsd.exe                    1828   1432      6    144 2019-03-22 05:32:10 UTC+0000
. 0xfffffa800474fb30:taskmgr.exe                     3792   1432      6    134 2019-03-22 05:34:38 UTC+0000
. 0xfffffa80053f83e0:EXCEL.EXE                       1272   1432     21    789 2019-03-22 05:33:49 UTC+0000
. 0xfffffa8004083880:FTK Imager.exe                  3192   1432      6    353 2019-03-22 05:35:12 UTC+0000
 0xfffffa8003c72b30:System                              4      0     87    547 2019-03-22 05:31:55 UTC+0000
. 0xfffffa8004616040:smss.exe                         252      4      2     30 2019-03-22 05:31:55 UTC+0000
 0xfffffa80050546b0:csrss.exe                         332    324     10    516 2019-03-22 05:31:58 UTC+0000
 0xfffffa8005259060:wininit.exe                       380    324      3     78 2019-03-22 05:31:58 UTC+0000
. 0xfffffa8005680910:services.exe                     476    380     12    224 2019-03-22 05:31:59 UTC+0000
.. 0xfffffa8005409060:dllhost.exe                    2072    476     13    194 2019-03-22 05:32:14 UTC+0000
.. 0xfffffa80055b0060:wmpnetwk.exe                   2628    476      9    210 2019-03-22 05:32:18 UTC+0000
.. 0xfffffa800583db30:svchost.exe                    1028    476     19    307 2019-03-22 05:32:05 UTC+0000
.. 0xfffffa8005775b30:svchost.exe                     796    476     15    368 2019-03-22 05:32:03 UTC+0000
... 0xfffffa80059e6890:dwm.exe                       1344    796      3     88 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005508650:SearchIndexer.                 2456    476     13    766 2019-03-22 05:32:17 UTC+0000
.. 0xfffffa80057beb30:svchost.exe                     932    476     10    568 2019-03-22 05:32:03 UTC+0000
.. 0xfffffa800432f060:svchost.exe                    3300    476     13    346 2019-03-22 05:34:15 UTC+0000
.. 0xfffffa8005478060:msdtc.exe                      2188    476     12    146 2019-03-22 05:32:15 UTC+0000
.. 0xfffffa800577db30:svchost.exe                     820    476     33   1073 2019-03-22 05:32:03 UTC+0000
... 0xfffffa80059cc620:taskeng.exe                   1292    820      4     83 2019-03-22 05:32:07 UTC+0000
... 0xfffffa8004300620:taskeng.exe                   1156    820      4     93 2019-03-22 05:34:14 UTC+0000
.. 0xfffffa80059cb7c0:taskhost.exe                   1276    476      8    183 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005b4eb30:vmtoolsd.exe                   1852    476     10    314 2019-03-22 05:32:11 UTC+0000
.. 0xfffffa800570d060:svchost.exe                     672    476      7    341 2019-03-22 05:32:02 UTC+0000
.. 0xfffffa8005a324e0:FileZilla Serv                 1476    476      9     81 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005c4ab30:svchost.exe                    2888    476     11    152 2019-03-22 05:32:20 UTC+0000
.. 0xfffffa8005ba0620:ManagementAgen                 1932    476     10    102 2019-03-22 05:32:11 UTC+0000
.. 0xfffffa80056e1060:svchost.exe                     592    476      9    375 2019-03-22 05:32:01 UTC+0000
... 0xfffffa80054d2380:WmiPrvSE.exe                  2196    592     11    222 2019-03-22 05:32:15 UTC+0000
... 0xfffffa8005c8e440:WmiPrvSE.exe                  2436    592      9    245 2019-03-22 05:32:33 UTC+0000
... 0xfffffa80047cb060:iexplore.exe                  3576    592     12    403 2019-03-22 05:34:48 UTC+0000
.... 0xfffffa80047e9540:iexplore.exe                 2780   3576      6    233 2019-03-22 05:34:48 UTC+0000
.. 0xfffffa8005850a30:spoolsv.exe                     864    476     12    279 2019-03-22 05:32:04 UTC+0000
.. 0xfffffa80057e4560:svchost.exe                     232    476     15    410 2019-03-22 05:32:03 UTC+0000
.. 0xfffffa80058ed390:OfficeClickToR                 1136    476     23    631 2019-03-22 05:32:05 UTC+0000
.. 0xfffffa8005af24e0:VGAuthService.                 1768    476      3     89 2019-03-22 05:32:09 UTC+0000
.. 0xfffffa8004330b30:sppsvc.exe                     3260    476      4    149 2019-03-22 05:34:15 UTC+0000
.. 0xfffffa800575e5b0:svchost.exe                     764    476     20    447 2019-03-22 05:32:02 UTC+0000
. 0xfffffa80056885e0:lsass.exe                        484    380      7    650 2019-03-22 05:32:00 UTC+0000
. 0xfffffa8005696b30:lsm.exe                          492    380     10    155 2019-03-22 05:32:00 UTC+0000
 0xfffffa8005268b30:winlogon.exe                      416    364      3    110 2019-03-22 05:31:58 UTC+0000
 0xfffffa800525a9e0:csrss.exe                         372    364     11    557 2019-03-22 05:31:58 UTC+0000
. 0xfffffa80042ab620:conhost.exe                     1008    372      2     55 2019-03-22 05:34:12 UTC+0000
. 0xfffffa8005c1ab30:conhost.exe                     4656    372      2     49 2019-03-22 05:35:36 UTC+0000
 0xfffffa8005be12c0:FileZilla Serv                   1996   1860      3     99 2019-03-22 05:32:12 UTC+0000

#5 Respuesta: 10.0.0.10

What was the IP address of the machine at the time the RAM dump was created?

Obtención de la evidencia

Una de las opciones con la que podemos sacar esta información es con netscan

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan
Volatility Foundation Volatility Framework 2.6.1
Offset(P)          Proto    Local Address                  Foreign Address      State            Pid      Owner          Created
0x13e057300        UDPv4    10.0.0.101:55736               *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05b4f0        UDPv6    ::1:55735                      *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05b790        UDPv6    fe80::7475:ef30:be18:7807:55734 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05d4b0        UDPv6    fe80::7475:ef30:be18:7807:1900 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05dec0        UDPv4    127.0.0.1:55737                *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05e3f0        UDPv4    10.0.0.101:1900                *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05eab0        UDPv6    ::1:1900                       *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e064d70        UDPv4    127.0.0.1:1900                 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e02bcf0        TCPv4    -:49220                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e035790        TCPv4    -:49223                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e036470        TCPv4    -:49224                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e258010        UDPv4    127.0.0.1:55560                *:*                                   5116     wscript.exe    2019-03-22 05:35:32 UTC+0000
0x13e305a50        UDPv4    0.0.0.0:5355                   *:*                                   232      svchost.exe    2019-03-22 05:32:09 UTC+0000
0x13e360be0        UDPv4    0.0.0.0:63790                  *:*                                   504                     2019-03-22 05:45:47 UTC+0000
0x13e490ec0        UDPv4    0.0.0.0:5355                   *:*                                   232      svchost.exe    2019-03-22 05:32:09 UTC+0000
0x13e490ec0        UDPv6    :::5355                        *:*                                   232      svchost.exe    2019-03-22 05:32:09 UTC+0000
0x13e5683e0        UDPv4    10.0.0.101:137                 *:*                                   4        System         2019-03-22 05:32:06 UTC+0000
0x13e594250        UDPv4    10.0.0.101:138                 *:*                                   4        System         2019-03-22 05:32:06 UTC+0000
0x13e597ec0        UDPv4    0.0.0.0:0                      *:*                                   232      svchost.exe    2019-03-22 05:32:06 UTC+0000
0x13e597ec0        UDPv6    :::0                           *:*                                   232      svchost.exe    2019-03-22 05:32:06 UTC+0000
0x13e61fb30        UDPv6    fe80::7475:ef30:be18:7807:546  *:*                                   764      svchost.exe    2019-03-22 05:46:23 UTC+0000
0x13e918010        UDPv4    0.0.0.0:56372                  *:*                                   1816     chrome.exe     2019-03-22 05:45:51 UTC+0000
0x13e9cd730        UDPv4    127.0.0.1:57374                *:*                                   1136     OfficeClickToR 2019-03-22 05:32:18 UTC+0000
0x13ea8e6a0        UDPv4    127.0.0.1:61704                *:*                                   3688     OUTLOOK.EXE    2019-03-22 05:34:44 UTC+0000
0x13ead0bf0        UDPv4    127.0.0.1:55614                *:*                                   4048     POWERPNT.EXE   2019-03-22 05:35:15 UTC+0000
0x13ebc6c20        UDPv4    0.0.0.0:5353                   *:*                                   3248     chrome.exe     2019-03-22 05:35:17 UTC+0000
0x13ebea890        UDPv4    0.0.0.0:5353                   *:*                                   3248     chrome.exe     2019-03-22 05:35:17 UTC+0000
0x13ebea890        UDPv6    :::5353                        *:*                                   3248     chrome.exe     2019-03-22 05:35:17 UTC+0000
0x13e2c6b10        TCPv4    0.0.0.0:21                     0.0.0.0:0            LISTENING        1476     FileZilla Serv 
0x13e2c6b10        TCPv6    :::21                          :::0                 LISTENING        1476     FileZilla Serv 
0x13e2c7850        TCPv6    ::1:14147                      :::0                 LISTENING        1476     FileZilla Serv 
0x13e2c96b0        TCPv4    127.0.0.1:14147                0.0.0.0:0            LISTENING        1476     FileZilla Serv 
0x13e2c9be0        TCPv4    0.0.0.0:21                     0.0.0.0:0            LISTENING        1476     FileZilla Serv 
0x13e3a1150        TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        484      lsass.exe      
0x13e3a1150        TCPv6    :::49155                       :::0                 LISTENING        484      lsass.exe      
0x13e3b2010        TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        484      lsass.exe      
0x13e430580        TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        820      svchost.exe    
0x13e430580        TCPv6    :::49154                       :::0                 LISTENING        820      svchost.exe    
0x13e431820        TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        820      svchost.exe    
0x13e57e010        TCPv4    10.0.0.101:139                 0.0.0.0:0            LISTENING        4        System         
0x13e71cef0        TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        672      svchost.exe    
0x13e720660        TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        672      svchost.exe    
0x13e720660        TCPv6    :::135                         :::0                 LISTENING        672      svchost.exe    
0x13e72f010        TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        380      wininit.exe    
0x13e72f6e0        TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        380      wininit.exe    
0x13e72f6e0        TCPv6    :::49152                       :::0                 LISTENING        380      wininit.exe    
0x13e770240        TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        764      svchost.exe    
0x13e772980        TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        764      svchost.exe    
0x13e772980        TCPv6    :::49153                       :::0                 LISTENING        764      svchost.exe    
0x13ebb3010        TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        476      services.exe   
0x13ebb3010        TCPv6    :::49156                       :::0                 LISTENING        476      services.exe   
0x13ebcdef0        TCPv4    0.0.0.0:80                     0.0.0.0:0            LISTENING        3952     hfs.exe        
0x13e2348a0        TCPv4    -:49366                        192.168.206.181:389  CLOSED           504                     
0x13e397190        TCPv4    10.0.0.101:49217               10.0.0.106:4444      ESTABLISHED      3496     UWkpjFjDzM.exe 
0x13e3986d0        TCPv4    -:49378                        213.209.1.129:25     CLOSED           504                     
0x13e3abae0        TCPv4    -:49226                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e3e7010        TCPv6    -:0                            38db:7705:80fa:ffff:38db:7705:80fa:ffff:0 CLOSED           1136     OfficeClickToR 
0x13e441830        TCPv6    -:0                            382b:c703:80fa:ffff:382b:c703:80fa:ffff:0 CLOSED           1        ?RK????       
0x13e4e4910        TCPv4    10.0.0.101:49208               52.109.12.6:443      CLOSED           504                     
0x13e55fae0        TCPv4    10.0.0.101:49209               52.96.44.162:443     CLOSED           504                     
0x13e71b540        TCPv4    -:0                            104.208.112.5:0      CLOSED           1        ?RK????       
0x13e73b560        TCPv4    -:49266                        35.190.69.156:443    CLOSED           504                     
0x13e7c6010        TCPv4    10.0.0.101:49204               172.217.6.195:443    CLOSED           1816     chrome.exe     
0x13ead7cf0        TCPv4    10.0.0.101:49202               172.217.10.68:443    CLOSED           1816     chrome.exe     
0x13f5898a0        TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        476      services.exe   
0x13f5899c0        TCPv4    0.0.0.0:445                    0.0.0.0:0            LISTENING        4        System         
0x13f5899c0        TCPv6    :::445                         :::0                 LISTENING        4        System         
0x13f4facf0        TCPv4    10.0.0.101:49262               52.109.12.6:443      ESTABLISHED      3688     OUTLOOK.EXE    
0x13f50a010        TCPv4    -:49265                        213.186.33.3:443     CLOSED           504                     
0x13f5289f0        TCPv4    -:49234                        72.51.60.133:80      CLOSED           3688     OUTLOOK.EXE    
0x13f7b4ec0        UDPv4    0.0.0.0:55707                  *:*                                   232      svchost.exe    2019-03-22 05:45:44 UTC+0000
0x13f7e8670        UDPv4    127.0.0.1:59411                *:*                                   3576     iexplore.exe   2019-03-22 05:34:49 UTC+0000
0x13fc6f1b0        UDPv4    0.0.0.0:55102                  *:*                                   232      svchost.exe    2019-03-22 05:45:36 UTC+0000
0x13fc78dc0        UDPv4    127.0.0.1:53361                *:*                                   1272     EXCEL.EXE      2019-03-22 05:34:03 UTC+0000
0x13f7ae010        TCPv4    10.0.0.101:49263               52.96.44.162:443     ESTABLISHED      3688     OUTLOOK.EXE    
0x13fa93cf0        TCPv4    -:49173                        72.51.60.132:443     CLOSED           1272     EXCEL.EXE      
0x13fa95cf0        TCPv4    -:49170                        72.51.60.132:443     CLOSED           1272     EXCEL.EXE      
0x13fa969f0        TCPv4    -:0                            56.219.119.5:0       CLOSED           1272     EXCEL.EXE      
0x13fbd07e0        TCPv4    -:49372                        212.227.15.9:25      CLOSED           504                     
0x13fc857e0        TCPv4    -:49167                        72.51.60.132:443     CLOSED           1272     EXCEL.EXE   

#6 Respuesta: 10.0.0.106

Based on the answer regarding the infected PID, can you determine the IP of the attacker?

Obtención de la evidencia

De la misma forma que en la pregunta #5 empleamos la opción netscan y filtramos por el nombre del fichero

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan | grep UWkpjFjDzM.exe
Volatility Foundation Volatility Framework 2.6.1
0x13e397190        TCPv4    10.0.0.101:49217               10.0.0.106:4444      ESTABLISHED      3496     UWkpjFjDzM.exe 

#Respuesta: 6

How many processes are associated with VCRUNTIME140.dll?

Obtención de la evidencia

Mediante dlllist listamos todas las DLL.

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 dlllist | grep VCRUNTIME140.dll
Volatility Foundation Volatility Framework 2.6.1
0x000007fefa5c0000            0x16000             0xffff 2019-03-22 05:32:05 UTC+0000   C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll
0x00000000745f0000            0x15000             0xffff 2019-03-22 05:33:49 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000            0x15000             0xffff 2019-03-22 05:34:37 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000            0x15000                0x3 2019-03-22 05:34:49 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000            0x15000             0xffff 2019-03-22 05:35:09 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll

Mas información

#8 Respuesta: 690ea20bc3bdfb328e23005d9a80c290

After dumping the infected process, what is its md5 hash?

Obtención de la evidencia

Mediante procdump descargamos el malware

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 procdump -D malware/ -p 3496
Volatility Foundation Volatility Framework 2.6.1
Process(V)         ImageBase          Name                 Result
------------------ ------------------ -------------------- ------
0xfffffa8005a1d9e0 0x0000000000400000 UWkpjFjDzM.exe       OK: executable.3496.exe

Una vez descargado comprobamos el hash

md5sum malware/executable.3496.exe 
690ea20bc3bdfb328e23005d9a80c290  malware/executable.3496.exe

#9 Respuesta: aad3b435b51404eeaad3b435b51404ee

What is the LM hash of Bob's account?

Obtención de la evidencia

Realizamos un Dump de todos los hash con la opción hashdump

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 hashdump 
Volatility Foundation Volatility Framework 2.6.1
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Bob:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Mas información

#10 Respuesta: PAGE_READONLY

What memory protection constants does the VAD node at 0xfffffa800577ba10 have?

Obtención de la evidencia

Mediante la utilidad vainfo listamos y grepeamos por la dirección 0xfffffa800577ba10

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 vadinfo | grep -A 3 0xfffffa800577ba10 
Volatility Foundation Volatility Framework 2.6.1
VAD node @ 0xfffffa800577ba10 Start 0x0000000000030000 End 0x0000000000033fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
Vad Type: VadNone

#11 Respuesta: PAGE_NOACCESS

What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?

Obtención de la evidencia

De la misma forma que en la pregunta #10 empleamos vainfo y grepeamos por «Start 0x00000000033c0000 End 0x00000000033dffff

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 vadinfo | grep -A 3 "Start 0x00000000033c0000 End 0x00000000033dffff"
Volatility Foundation Volatility Framework 2.6.1
VAD node @ 0xfffffa80052652b0 Start 0x00000000033c0000 End 0x00000000033dffff Tag VadS
Flags: CommitCharge: 32, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS

Vad Type: VadNone

12 Respuesta: vhjReUDEuumr

There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)

Obtención de la evidencia

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 cmdline | grep vbs
Volatility Foundation Volatility Framework 2.6.1
Command line : "C:\Windows\System32\wscript.exe" //B //NOLOGO %TEMP%\vhjReUDEuumrX.vbs

Mas información

#13 Respuesta: Skype.exe

An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)

Obtención de la evidencia

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 shimcache  | grep "2019-03-07 23:06:58" 
Volatility Foundation Volatility Framework 2.6.1
2019-03-07 23:06:58 UTC+0000   \??\C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe

Mas información

Amcache and Shimcache in forensic analysis

Volatility, my own cheatsheet (Part 6): Windows Registry

14 Respuesta: flag<REDBULL_IS_LIFE>

What was written in notepad.exe at the time when the memory dump was captured?

Obtención de la evidencia

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 memdump --dump-dir=./notepad/ -p 3032 
Volatility Foundation Volatility Framework 2.6.1
************************************************************************
Writing notepad.exe [  3032] to 3032.dmp

Filtramos los strings empleando «flag<«

strings -e l notepad/3032.dmp  | grep "flag<"
flag<REDBULL_IS_LIFE>
flag<Th>
flag<Th>
flag<TheK>
flag<TheK>

Mas información

#15 Respuesta:

What is the short name of the file at file record 59045?

Obtención de la evidencia

Volcamos toda la tabla MFT

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 mftparser > Documents/59045.txt
Volatility Foundation Volatility Framework 2.6.1

Buscamos por 59045

MFT entry found at offset 0x2193d400
Attribute: In Use & File
Record Number: 59045

Link count: 2


$STANDARD_INFORMATION
Creation                       Modified                       MFT Altered                    Access Date                    Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:42 UTC+0000   Archive

$FILE_NAME
Creation                       Modified                       MFT Altered                    Access Date                    Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:42 UTC+0000   Users\Bob\DOCUME~1\EMPLOY~1\EMPLOY~1.XLS

$FILE_NAME
Creation                       Modified                       MFT Altered                    Access Date                    Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:42 UTC+0000   Users\Bob\DOCUME~1\EMPLOY~1\EmployeeInformation.xlsx

Mas información

#16 Respuesta: 3496

This box was exploited and is running meterpreter. What was the infected PID

Empleando la utilidad netscan vemos todas las conexiones abiertas, filtramos por el proceso (UWkpjFjDzM.exe) el cual ya lo vimos en la pregunta #6

Como podemos observar tenemos una conexión establecida por el puerto 4444 y el PID 3496

vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan | grep UWkpjFjDzM.exe 
Volatility Foundation Volatility Framework 2.6.1
0x13e397190        TCPv4    10.0.0.101:49217               10.0.0.106:4444      ESTABLISHED      3496     UWkpjFjDzM.exe 

:wq!

Deja una respuesta

Tu dirección de correo electrónico no será publicada. Los campos obligatorios están marcados con *