Jul 6, 2018 06:28 AM
(This post was last modified: Jul 8, 2018 05:10 AM by CyberStrike.)
Foreword: I encourage everyone to participate, whether or not you have done this before or not, hands on is the best way to learn and I have included resources on volatility, which is a commonly used memory forensics framework. The solution will be posted on Monday, as to give everyone enough time to work on this challenge. If you can answer some questions great, if you can complete the whole challenge even better.
For an example of the write up, using pastebin for large blocks of text is fine and encouraged.
https://hackforums.net/showthread.php?ti...id56810368
Volatility or Rekall
whois
reglookup
autopsy/foremost
Yara
Google
sha256sum
strings
VirusTotal
Once again no need for Kali/Caine/Deft/SANS Sift of course if you want you can use whatever you want.
Scenario: A friend from another country is a well known journalist, who writes articles exposing government corruption and civil rights abuses, unfortunately they have reason to suspect that they may have been infected by a malware from a government entity. and she needs your help.
Image Download: http://www.mediafire.com/file/yxqodp1p2a...apftis.rar
Password: infected
RAR sha256sum: 0ab81aec6d61593a03a7b6fbda9266af8dd9c8df1b6477faa880fafd19cb21b1 0zapftis.rar
Extracted File Type: vmem
https://github.com/volatilityfoundation/volatility/wiki
https://resources.infosecinstitute.com/m...olatility/
https://github.com/volatilityfoundation/...-Reference
Common Malware Registry locations:
https://resources.infosecinstitute.com/c...echanisms/
Yara Rules:
https://github.com/Yara-Rules/rules
Edit: Something I wanted to add, is that by understanding how a defender defends you can be a better attacker. For example you have to know what AV and figure out a way of bypassing that AV, the same principal here seeing how other attackers do their work will give you an idea of different tactics and techniques. Also seeing what an analyst can pick out of just a memory dump of a machine, which is what this is just a snapshot of a compromised machine, it can give you a better idea on how to avoid or hamper an analyst when they are looking at a machine you have compromised. So this is not just a look at a defender's toolset instead you can use it to further your attacks, and be more aware of what is left behind after an attack.
For an example of the write up, using pastebin for large blocks of text is fine and encouraged.
https://hackforums.net/showthread.php?ti...id56810368
Quote:Tools:
Volatility or Rekall
whois
reglookup
autopsy/foremost
Yara
sha256sum
strings
VirusTotal
Once again no need for Kali/Caine/Deft/SANS Sift of course if you want you can use whatever you want.
Scenario: A friend from another country is a well known journalist, who writes articles exposing government corruption and civil rights abuses, unfortunately they have reason to suspect that they may have been infected by a malware from a government entity. and she needs your help.
Image Download: http://www.mediafire.com/file/yxqodp1p2a...apftis.rar
Password: infected
RAR sha256sum: 0ab81aec6d61593a03a7b6fbda9266af8dd9c8df1b6477faa880fafd19cb21b1 0zapftis.rar
Extracted File Type: vmem
Quote:Resources:
https://github.com/volatilityfoundation/volatility/wiki
https://resources.infosecinstitute.com/m...olatility/
https://github.com/volatilityfoundation/...-Reference
Common Malware Registry locations:
https://resources.infosecinstitute.com/c...echanisms/
Yara Rules:
https://github.com/Yara-Rules/rules
Quote:Questions:
Questions on machine state:
What OS is used on the machine?
What processes are running and do any stand out?
What files are currently in the memory? Drivers and Windows objects, and do any of these stand out?
What networking connections and ports are present on the machine?
Do any of these connections or ports used stand out? If so why?
If there is a connection what country does does this IP block belong to?
Malware Questions:
Is there malware present on the machine?
If there is malware dump the file and get the sha256 and identify the malware, also what has the malware changed to the system?
Have any commands been issued in a shell? If so what are these commands?
What methods of persistence are used in this malware?
Attribution:
What country could be responsible? Make sure to post relevant sources to support your conclusion.
Edit: Something I wanted to add, is that by understanding how a defender defends you can be a better attacker. For example you have to know what AV and figure out a way of bypassing that AV, the same principal here seeing how other attackers do their work will give you an idea of different tactics and techniques. Also seeing what an analyst can pick out of just a memory dump of a machine, which is what this is just a snapshot of a compromised machine, it can give you a better idea on how to avoid or hamper an analyst when they are looking at a machine you have compromised. So this is not just a look at a defender's toolset instead you can use it to further your attacks, and be more aware of what is left behind after an attack.
![[Image: ngTY83T.gif]](https://i.imgur.com/ngTY83T.gif)
