Ransomware Forensics - Revision history

SKloss: /* Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility */

2024-01-08T16:43:41Z

Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility

← Older revision		Revision as of 16:43, 8 January 2024
Line 90:		Line 90:
	vol.py -f infected.vmem --profile=Win7SP1x86 cmdline \| grep <filename.exe>		vol.py -f infected.vmem --profile=Win7SP1x86 cmdline \| grep <filename.exe>

	** Find the filename for the file with the ransomware public key, it has a .eky extension.		* Find the filename for the file with the ransomware public key, it has a .eky extension.
	First make a memory dump of the malicious parent process with ''memdump'':		** First make a memory dump of the malicious parent process with ''memdump'':
	vol.py -f infected.vmem --profile=Win7SP1x86 memdump -p <PID> --dump-dir /home/user/directory		vol.py -f infected.vmem --profile=Win7SP1x86 memdump -p <PID> --dump-dir /home/user/directory

SKloss: /* Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility */

2024-01-08T16:43:15Z

Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility

SKloss: /* Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility */

2024-01-08T16:41:15Z

Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility

← Older revision		Revision as of 16:41, 8 January 2024
Line 68:		Line 68:
	This section describes the investigation of volatile memory of a machine that might have become the target of a ransomware attack.		This section describes the investigation of volatile memory of a machine that might have become the target of a ransomware attack.

	VMware memory dump and challenge are from Blue Teams Lab Online <ref name="BTLO"/>.		VMware memory dump and challenge are from Blue Teams Lab Online <ref name="BTLO"/>. The investigation is done with Volatility on a Kali Linux VM <ref name="Volatility"/>.

	The investigation is done with Volatility on a Kali Linux VM <ref name="Volatility"/>.

	First download memory dump to Kali Linux machine and unzip, ‘infected.vmem’ file is needed.		First download memory dump to Kali Linux machine and unzip, ‘infected.vmem’ file is needed.

SKloss: /* Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility */

2024-01-08T16:40:55Z

Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility

← Older revision		Revision as of 16:40, 8 January 2024
Line 67:		Line 67:

	This section describes the investigation of volatile memory of a machine that might have become the target of a ransomware attack.		This section describes the investigation of volatile memory of a machine that might have become the target of a ransomware attack.

	VMware memory dump and challenge are from Blue Teams Lab Online <ref name="BTLO"/>.		VMware memory dump and challenge are from Blue Teams Lab Online <ref name="BTLO"/>.

	The investigation is done with Volatility on a Kali Linux VM <ref name="Volatility"/>.		The investigation is done with Volatility on a Kali Linux VM <ref name="Volatility"/>.
	First download memory dump to Kali Linux machine and unzip, ‘infected.vmem’ file is needed. Then start the memory forensics investigation with Volatility.
			First download memory dump to Kali Linux machine and unzip, ‘infected.vmem’ file is needed.
			Then start the memory forensics investigation with Volatility.

	Find out the OS of the infected machine with ''imageinfo'':		Find out the OS of the infected machine with ''imageinfo'':

SKloss: /* References */

2024-01-08T16:40:03Z

References

← Older revision		Revision as of 16:40, 8 January 2024
Line 101:		Line 101:
	* cloudyforensics.medium.com. 2018. [https://cloudyforensics.medium.com/ransomware-incident-response-and-forensics-bbe74fb4cd98 Ransomware Incident Response and Forensics]		* cloudyforensics.medium.com. 2018. [https://cloudyforensics.medium.com/ransomware-incident-response-and-forensics-bbe74fb4cd98 Ransomware Incident Response and Forensics]
	* Dixon, S. 2021. [https://terguttac.medium.com/btlo-memory-analysis-ransomware-2523c2b5f864 BTLO: Memory Analysis — Ransomware]		* Dixon, S. 2021. [https://terguttac.medium.com/btlo-memory-analysis-ransomware-2523c2b5f864 BTLO: Memory Analysis — Ransomware]
			* infosecwriteups.com. 2021. [https://infosecwriteups.com/memory-analysis-ransomware-blueteamlabs-f49765cd5b9c Memory Analysis — Ransomware (BlueTeamLabs)]
			* Child, D. 2021. [https://dannychild.com/btlo-challenge-memory-analysis-ransomware/ BTLO Challenge - Memory Analysis - Ransomware. Identifying Ransomware from a memory dump]

	<references>		<references>
	<ref name="BTLO">Blue Teams Lab Online. 2021. [https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d Memory Analysis - Ransomware].</ref>		<ref name="BTLO">Blue Teams Lab Online. 2021. [https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d Memory Analysis - Ransomware].</ref>
	<ref name="Volatility">~~seanthegeek.net~~. 2021. [https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/ How to Install Volatility 2 and Volatility 3 on Debian, Ubuntu, or Kali Linux].</ref>		<ref name="Volatility">Whalen, S. 2021. [https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/ How to Install Volatility 2 and Volatility 3 on Debian, Ubuntu, or Kali Linux].</ref>
	</references>		</references>


	[[Category:Basic]]		[[Category:Basic]]

SKloss: /* References */

2024-01-08T16:36:02Z

References

← Older revision		Revision as of 16:36, 8 January 2024
Line 100:		Line 100:
	* University of Maryland, Department of Information Technology. 2023. [https://itsupport.umd.edu/itsupport?id=kb_article_view&sysparm_article=KB0013905 Incident Response Steps: Potential Ransomware Infection]		* University of Maryland, Department of Information Technology. 2023. [https://itsupport.umd.edu/itsupport?id=kb_article_view&sysparm_article=KB0013905 Incident Response Steps: Potential Ransomware Infection]
	* cloudyforensics.medium.com. 2018. [https://cloudyforensics.medium.com/ransomware-incident-response-and-forensics-bbe74fb4cd98 Ransomware Incident Response and Forensics]		* cloudyforensics.medium.com. 2018. [https://cloudyforensics.medium.com/ransomware-incident-response-and-forensics-bbe74fb4cd98 Ransomware Incident Response and Forensics]
	*		* Dixon, S. 2021. [https://terguttac.medium.com/btlo-memory-analysis-ransomware-2523c2b5f864 BTLO: Memory Analysis — Ransomware]

	<references>		<references>

SKloss: /* References */

2024-01-08T16:31:50Z

References

← Older revision		Revision as of 16:31, 8 January 2024
Line 104:		Line 104:
	<references>		<references>
	<ref name="BTLO">Blue Teams Lab Online. 2021. [https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d Memory Analysis - Ransomware].</ref>		<ref name="BTLO">Blue Teams Lab Online. 2021. [https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d Memory Analysis - Ransomware].</ref>
			<ref name="Volatility">seanthegeek.net. 2021. [https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/ How to Install Volatility 2 and Volatility 3 on Debian, Ubuntu, or Kali Linux].</ref>
	</references>		</references>
	<ref name="Volatility">seanthegeek.net. 2021. [https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/ How to Install Volatility 2 and Volatility 3 on Debian, Ubuntu, or Kali Linux].</ref>

	[[Category:Basic]]		[[Category:Basic]]

SKloss: /* Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility */

2024-01-08T16:30:58Z

Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility

← Older revision		Revision as of 16:30, 8 January 2024
Line 69:		Line 69:
	VMware memory dump and challenge are from Blue Teams Lab Online <ref name="BTLO"/>.		VMware memory dump and challenge are from Blue Teams Lab Online <ref name="BTLO"/>.

	The investigation is done with Volatility on a Kali Linux VM.		The investigation is done with Volatility on a Kali Linux VM <ref name="Volatility"/>.
	First download memory dump to Kali Linux machine and unzip, ‘infected.vmem’ file is needed. Then start the memory forensics investigation with Volatility.		First download memory dump to Kali Linux machine and unzip, ‘infected.vmem’ file is needed. Then start the memory forensics investigation with Volatility.

SKloss: /* References */

2024-01-08T16:29:46Z

References

← Older revision		Revision as of 16:29, 8 January 2024
Line 100:		Line 100:
	* University of Maryland, Department of Information Technology. 2023. [https://itsupport.umd.edu/itsupport?id=kb_article_view&sysparm_article=KB0013905 Incident Response Steps: Potential Ransomware Infection]		* University of Maryland, Department of Information Technology. 2023. [https://itsupport.umd.edu/itsupport?id=kb_article_view&sysparm_article=KB0013905 Incident Response Steps: Potential Ransomware Infection]
	* cloudyforensics.medium.com. 2018. [https://cloudyforensics.medium.com/ransomware-incident-response-and-forensics-bbe74fb4cd98 Ransomware Incident Response and Forensics]		* cloudyforensics.medium.com. 2018. [https://cloudyforensics.medium.com/ransomware-incident-response-and-forensics-bbe74fb4cd98 Ransomware Incident Response and Forensics]
			*

	<references>		<references>
	<ref name="BTLO">Blue Teams Lab Online. 2021. [https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d Memory Analysis - Ransomware].</ref>		<ref name="BTLO">Blue Teams Lab Online. 2021. [https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d Memory Analysis - Ransomware].</ref>
	</references>		</references>
			<ref name="Volatility">seanthegeek.net. 2021. [https://seanthegeek.net/1172/how-to-install-volatility-2-and-volatility-3-on-debian-ubuntu-or-kali-linux/ How to Install Volatility 2 and Volatility 3 on Debian, Ubuntu, or Kali Linux].</ref>

	[[Category:Basic]]		[[Category:Basic]]

SKloss: /* Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility */

2024-01-08T16:24:29Z

Ransomware Memory Forensics - Analysis of Ransomware Infected Memory Dump with Volatility

← Older revision		Revision as of 16:24, 8 January 2024
Line 93:		Line 93:
	vol.py -f infected.vmem --profile=Win7SP1x86 memdump -p <PID> --dump-dir /home/user/directory		vol.py -f infected.vmem --profile=Win7SP1x86 memdump -p <PID> --dump-dir /home/user/directory

	Then scan this memory dump with ''string'' for a file with .ek:		Then scan this memory dump with ''string'' for a file with .eky:
	strings /home/user/directory/<pid>.dmp \| grep .eky		strings /home/user/directory/<pid>.dmp \| grep .eky

← Older revision		Revision as of 16:43, 8 January 2024
Line 73:		Line 73:
	Then start the memory forensics investigation with Volatility.		Then start the memory forensics investigation with Volatility.

	Find out the OS of the infected machine with ''imageinfo'':		* Find out the OS of the infected machine with ''imageinfo'':
	vol.py -f infected.vmem imageinfo		vol.py -f infected.vmem imageinfo

	Use the OS finding (e.g. Win7SP1x86) as --profile.		Use the OS finding (e.g. Win7SP1x86) as --profile.

	Find the suspicious process with ''psscan'':		* Find the suspicious process with ''psscan'':
	vol.py -f infected.vmem --profile=Win7SP1x86 psscan		vol.py -f infected.vmem --profile=Win7SP1x86 psscan

	Find the initial malicious executable that created this process with ''pstree'', which gives a hierarchical list of the processes:		* Find the initial malicious executable that created this process with ''pstree'', which gives a hierarchical list of the processes:
	vol.py -f infected.vmem --profile=Win7SP1x86 pstree		vol.py -f infected.vmem --profile=Win7SP1x86 pstree

	Find the process used to delete files by filtering the ''psscan'' output for the suspicious PID:		* Find the process used to delete files by filtering the ''psscan'' output for the suspicious PID:
	vol.py -f infected.vmem --profile=Win7SP1x86 psscan \| grep <PID>		vol.py -f infected.vmem --profile=Win7SP1x86 psscan \| grep <PID>

	Find path where the malicious file was first executed with ''cmdline'' filtered for the filename of the malicious file, this gives the command line:		* Find path where the malicious file was first executed with ''cmdline'' filtered for the filename of the malicious file, this gives the command line:
	vol.py -f infected.vmem --profile=Win7SP1x86 cmdline \| grep <filename.exe>		vol.py -f infected.vmem --profile=Win7SP1x86 cmdline \| grep <filename.exe>

	Find the filename for the file with the ransomware public key, it has a .eky extension.		** Find the filename for the file with the ransomware public key, it has a .eky extension.
	First make a memory dump of the malicious parent process with ''memdump'':		First make a memory dump of the malicious parent process with ''memdump'':
	vol.py -f infected.vmem --profile=Win7SP1x86 memdump -p <PID> --dump-dir /home/user/directory		vol.py -f infected.vmem --profile=Win7SP1x86 memdump -p <PID> --dump-dir /home/user/directory

	Then scan this memory dump with ''string'' for a file with .eky:		** Then scan this memory dump with ''string'' for a file with .eky:
	strings /home/user/directory/<pid>.dmp \| grep .eky		strings /home/user/directory/<pid>.dmp \| grep .eky