Digital Forensics: TryHackMe Forensics writeup.
This challenge is based on Memory Forensics
This is a memory dump of compromised system, do some forensics kung-fu to explore the inside.
Task 1: Information gather
#volatility imageinfo -f Desktop/victim.raw
Looking for ‘SearchIndexer’ PID
#volatility -f Desktop/victim.raw --profile=Win7SP1x64 pslist | grep SearchIndexer
This information is stored by Windows using two registry keys called ShellBags.
#volatility -f victim.raw --profile=Win7SP1x64 shellbags
Last accessed directory
The ‘deleted_file’ is the last directory accessed by the user.
Task 2: Search for malicious processes
Let ‘s scan the open port using the following command
First we need to find a suspicious open port. Use netscan to find out open ports:
#volatility -f Desktop/victim.raw --profile=Win7SP1x64 netscan
PID 1368,2464 with multiple ports which look suspicious
How about dump the process and check with Virus total?
1820.dmp 1820 shows malicious sign. 2 security vendors and no sandboxes flagged this file as malicious
Task 3: Indicators of compromise (IOC)
We can dump the memory using the following command.
#volatility -f victim.raw -p <malicious PID> --profile=Win7SP1x64 memdump <Directory to save the file>
# strings Desktop/malware/1820.dmp | grep '\<www\.go....\.ru\>'
# strings Desktop/malware/1820.dmp | grep '\<www\.i....\.com\>'
# strings Desktop/malware/1820.dmp | grep '\<www\.ic......\.com\>'
# strings Desktop/malware/1820.dmp | grep '\<202\....\.233\....\>'
# strings Desktop/malware/1820.dmp | grep '\<...\.200\...\.164\>'
# strings Desktop/malware/1820.dmp | grep '\<209\.190\....\....\>'
To check with the environment variable from the memory image
#volatility Desktop/victim.raw -p 2464 --profile=Win7SP1x64 envars
You've completed the room!
อ่านเพิ่ม Memory Forensics
หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ
#WindowsForensic #computerforensic #ComputerForensics #dfir #forensics
#digitalforensics #investigation #cybercrime #fraud
%20duplication.jpg "CCTV Forensics Disk-to-Disk (clone) duplication")
%20%20Save%20log.jpg "Disk-to-Disk (clone) save log")
%20duplication1.png "--- The scenario shows that we can use this method to clone the source and then acquire the hash log for integrity purposes. -- --- Hence, following the practice above, we can extract the video content from CCTV evidence. However, it is essential to gain requirements from the client because it helps to shorten the process. -- --- If we can bring the CCTV machine along with the evidence source, we can produce a potential result. --")
%20duplication2.png "CCTV Forensics Disk-to-Disk (clone) duplication")
%20duplication3.jpg "CCTV Forensics Disk-to-Disk (clone) duplication")
%20duplication4.jpg "CCTV Forensics Disk-to-Disk (clone) duplication")
.jpg)
