search

Szechuan Sauce - Case Investigation

What’s the Operating System version of the Server? (two words)

# SOFTWARE registry (DC)
2012 R2

What’s the Operating System of the Desktop? (four words separated by spaces)

# SOFTWARE registry (DESKTOP)
Windows 10 Enterprise Evaluation

What was the IP address assigned to the domain controller?

# \SYSTEM: ControlSet001\Services\Tcpip\Parameters\Interfaces\
10.42.85.10

What was the timezone of the Server?

UTC-8

What was the initial entry vector (how did they get in)?. Provide protocol name.

# We must think one thing, most of the attacks are coming from RDP like ssh, smb, ftp and others.
# The other things is we need to view wireshark and brimsecurity(recommand)
RDP

What was the malicious process used by the malware? (one word)

$ python3 vol.py -f ../citadeldc01.mem windows.info
$ python3 vol.py -f ../citadeldc01.mem windows.pslist.PsList
Volatility 3 Framework 1.0.1
Progress:  100.00        PDB scanning finished                     
PID    PPID    ImageFileName    Offset(V)    Threads    Handles    SessionId    Wow64    CreateTime    ExitTime    File output

4    0    System    0xe0005f273040    98    -    N/A    False    2020-09-19 01:22:38.000000     N/A    Disabled
204    4    smss.exe    0xe00060354900    2    -    N/A    False    2020-09-19 01:22:38.000000     N/A    Disabled
324    316    csrss.exe    0xe000602c2080    8    -    0    False    2020-09-19 01:22:39.000000     N/A    Disabled
404    316    wininit.exe    0xe000602cc900    1    -    0    False    2020-09-19 01:22:40.000000     N/A    Disabled
412    396    csrss.exe    0xe000602c1900    10    -    1    False    2020-09-19 01:22:40.000000     N/A    Disabled
452    404    services.exe    0xe00060c11080    5    -    0    False    2020-09-19 01:22:40.000000     N/A    Disabled
460    404    lsass.exe    0xe00060c0e080    31    -    0    False    2020-09-19 01:22:40.000000     N/A    Disabled
492    396    winlogon.exe    0xe00060c2a080    4    -    1    False    2020-09-19 01:22:40.000000     N/A    Disabled
640    452    svchost.exe    0xe00060c84900    8    -    0    False    2020-09-19 01:22:40.000000     N/A    Disabled
684    452    svchost.exe    0xe00060c9a700    6    -    0    False    2020-09-19 01:22:40.000000     N/A    Disabled
800    452    svchost.exe    0xe00060ca3900    12    -    0    False    2020-09-19 01:22:40.000000     N/A    Disabled
808    492    dwm.exe    0xe00060d09680    7    -    1    False    2020-09-19 01:22:40.000000     N/A    Disabled
848    452    svchost.exe    0xe00060d1e080    39    -    0    False    2020-09-19 01:22:41.000000     N/A    Disabled
928    452    svchost.exe    0xe00060d5d500    16    -    0    False    2020-09-19 01:22:41.000000     N/A    Disabled
1000    452    svchost.exe    0xe00060da2080    18    -    0    False    2020-09-19 01:22:41.000000     N/A    Disabled
668    452    svchost.exe    0xe00060e09900    16    -    0    False    2020-09-19 01:22:41.000000     N/A    Disabled
1292    452    Microsoft.Acti    0xe00060f73900    9    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1332    452    dfsrs.exe    0xe00060fe1900    16    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1368    452    dns.exe    0xe00060ff3080    16    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1392    452    ismserv.exe    0xe00060ff7900    6    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1556    452    VGAuthService.    0xe000614aa200    2    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1600    452    vmtoolsd.exe    0xe00061a30900    9    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1644    452    wlms.exe    0xe00061a9a800    2    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1660    452    dfssvc.exe    0xe00061a9b2c0    11    -    0    False    2020-09-19 01:22:57.000000     N/A    Disabled
1956    452    svchost.exe    0xe0006291b7c0    30    -    0    False    2020-09-19 01:23:20.000000     N/A    Disabled
796    452    vds.exe    0xe000629b3080    11    -    0    False    2020-09-19 01:23:20.000000     N/A    Disabled
1236    452    svchost.exe    0xe000629926c0    8    -    0    False    2020-09-19 01:23:21.000000     N/A    Disabled
2056    640    WmiPrvSE.exe    0xe000629de900    11    -    0    False    2020-09-19 01:23:21.000000     N/A    Disabled
2216    452    dllhost.exe    0xe00062a26900    10    -    0    False    2020-09-19 01:23:21.000000     N/A    Disabled
2460    452    msdtc.exe    0xe00062a2a900    9    -    0    False    2020-09-19 01:23:21.000000     N/A    Disabled
3724    452    spoolsv.exe    0xe000631cb900    13    -    0    False    2020-09-19 03:29:40.000000     N/A    Disabled
3644    2244    coreupdater.ex    0xe00062fe7700    0    -    2    False    2020-09-19 03:56:37.000000     2020-09-19 03:56:52.000000     Disabled
3796    848    taskhostex.exe    0xe00062f04900    7    -    1    False    2020-09-19 04:36:03.000000     N/A    Disabled
3472    3960    explorer.exe    0xe00063171900    39    -    1    False    2020-09-19 04:36:03.000000     N/A    Disabled
400    1904    ServerManager.    0xe00060ce2080    10    -    1    False    2020-09-19 04:36:03.000000     N/A    Disabled
3260    3472    vm3dservice.ex    0xe00063299280    1    -    1    False    2020-09-19 04:36:14.000000     N/A    Disabled
2608    3472    vmtoolsd.exe    0xe00062ede1c0    8    -    1    False    2020-09-19 04:36:14.000000     N/A    Disabled
2840    3472    FTK Imager.exe    0xe00063021900    9    -    1    False    2020-09-19 04:37:04.000000     N/A    Disabled
3056    848    WMIADAP.exe    0xe0006313f900    5    -    0    False    2020-09-19 04:37:42.000000     N/A    Disabled
2764    640    WmiPrvSE.exe    0xe00062c0a900    6    -    0    False    2020-09-19 04:37:42.000000     N/A    Disabled
coreupdater

Which process did malware migrate to after the initial compromise? (one word)

Identify the IP Address that delivered the payload.

What IP Address was the malware calling to?

Where did the malware reside on the disk?

What's the name of the attack tool you think this malware belongs to? (one word)

One of the involved malicious IP's is based in Thailand. What was the IP?

Another malicious IP once resolved to klient-293.xyz . What is this IP?

The attacker performed some lateral movements and accessed another system in the environment via RDP. What is the hostname of that system?

Other than the administrator, which user has logged into the Desktop machine? (two words)

What was the password for "jerrysmith" account?

What was the original filename for Beth’s secrets?

PreviousSpotlight - MAC Image ForensicsNextNetwork Forensics

Last updated