SlideShare a Scribd company logo

Computer Forensics Report - FRS301 - FPT University

Download as DOCX, PDF
Duc Lai Trung Minh, profile picture
Duc Lai Trung Minh

The computer forensics report summarizes the investigation of a suspected machine's hard drive (HDD) and random access memory (RAM). Two deleted files were recovered from the HDD, which appeared to be course files. The operating system detected from analyzing the RAM was determined to be either Windows 7 or Windows Server 2008. Various running processes and network connections were extracted, including evidence of iexplore and notepad instances.

Technology
1 of 12
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
Computer Forensics Report Team IA1161 Evidence Collector: Hoang Dinh Tuan Investigator: Dao Nguyen Van Thanh, Lai Trung Minh Duc Reporter: Lai Trung Minh Duc, Tran Long Nhat Phuong 01/02/18
Investigator Information The following report was conducted by Team IA1161 in the following process: - Tuan is the evidence collector who received captured images from Team IA1064 and presented to our investigator to deliver facts that would seem relevant to the case. The evidence is verified to be unaltered. - Thanh is our main investigator who is responsible for taking the evidence and doing necessary tasks to pursue the investigation. His investigation process will be given details in the third section of this report. - Duc and Phuong are in charge of writing this report based on the results from Thanh. Case Description In this project, we are given two image files capturing a suspected machine from Team IA1164: - Disk.001 – HDD captured image - Memdump.mem – RAM capturedimage We suspected that this machine might be attacked by Metasploit’s Payload for unauthorizedaccess. We also tried to restore any deleted files for further relevantdeduction. Computer and Forensic Tool Statistics The two files were collected at 01/02/18 8:27:03 AM when Tuan received them from Team IA1164. Team IA1161 then started given responsibilities to each member, once we settled and understood our missions, we began the research andtesting. The files were tested usingVolatilityprovided by a Kali machine and FTK Imager on Windows 7. These programs have been proven
by Mr. Nguyen Sieu Dang to provide valid and accurate results when scanningand analyzinga system.
Investigation: 1. Check hash of file to ensure the file haven’t been altered. 2. Investigate HDD to explore any deleted file As we can see, inside the investigatedHDD, we have several files. The noticeable point here are two deleted file. - 8498069.pdf was modified at 1/21/2018 10:06:57 AM - VTP-Challenge VTP Configuration (1).pka was modified at 1/17/2017 11:29:32 AM Restoring 2 files, what we have here is:
8498069.pdf is the tutorial of lab in CCNA VTP-Challenge VTP Configuration (1).pka is the lab file of CCNA Conclusion: After researchedthe HDD, we don’t find any remarkable point that relevantto our suspect. 3. Investigate RAM. By using the command [volatility -f memdump.mem imageinfo], we think that the OperatingSystem of the suspected machine might be: Windows 7 or Windows Server 2008.
Here is some of our tables for Processes list and Network list: Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0xfffffa80024b6740 System 4 0 88 555 ------ 0 2018-01-31 03:48:10 UTC+0000 0xfffffa8002fd8b30 smss.exe 244 4 2 29 ------ 0 2018-01-31 03:48:10 UTC+0000 0xfffffa800371cb30 csrss.exe 336 328 9 478 0 0 2018-01-31 03:48:21 UTC+0000 0xfffffa800373ab30 csrss.exe 388 380 10 296 1 0 2018-01-31 03:48:22 UTC+0000 0xfffffa8003742b30 wininit.exe 396 328 3 76 0 0 2018-01-31 03:48:22 UTC+0000 0xfffffa8003751b30 winlogon.exe 432 380 3 108 1 0 2018-01-31 03:48:22 UTC+0000 0xfffffa80037bb910 services.exe 492 396 7 215 0 0 2018-01-31 03:48:25 UTC+0000 0xfffffa80037cf910 lsass.exe 500 396 6 586 0 0 2018-01-31 03:48:26 UTC+0000 0xfffffa80037d5b30 lsm.exe 508 396 10 141 0 0 2018-01-31 03:48:26 UTC+0000 0xfffffa8003b1c470 svchost.exe 604 492 9 352 0 0 2018-01-31 03:48:30 UTC+0000 0xfffffa8003b3f060 vmacthlp.exe 664 492 3 54 0 0 2018-01-31 03:48:31 UTC+0000 0xfffffa8003b544a0 svchost.exe 708 492 8 274 0 0 2018-01-31 03:48:32 UTC+0000 0xfffffa8003b89630 svchost.exe 796 492 18 481 0 0 2018-01-31 03:48:33 UTC+0000 0xfffffa8003b9d060 svchost.exe 832 492 17 408 0 0 2018-01-31 03:48:34 UTC+0000 0xfffffa8003ba4780 svchost.exe 856 492 39 1040 0 0 2018-01-31 03:48:34 UTC+0000 0xfffffa8003bf6420 svchost.exe 1004 492 10 518 0 0 2018-01-31 03:48:36 UTC+0000 0xfffffa8003c3b630 svchost.exe 292 492 14 371 0 0 2018-01-31 03:48:38 UTC+0000 0xfffffa80036ff060 spoolsv.exe 1112 492 12 323 0 0 2018-01-31 03:48:40 UTC+0000 0xfffffa800370b060 svchost.exe 1148 492 17 308 0 0 2018-01-31 03:48:41 UTC+0000 0xfffffa80036aa060 svchost.exe 1300 492 16 243 0 0 2018-01-31 03:48:43 UTC+0000 0xfffffa800383e360 VGAuthService. 1420 492 3 88 0 0 2018-01-31 03:48:45 UTC+0000 0xfffffa80027a0b30 vmtoolsd.exe 1520 492 9 291 0 0 2018-01-31 03:48:49 UTC+0000 0xfffffa8002e83190 ManagementAgen 1548 492 10 92 0 0 2018-01-31 03:48:50 UTC+0000 0xfffffa8003d18b30 svchost.exe 1784 492 6 93 0 0 2018-01-31 03:48:53 UTC+0000 0xfffffa8003d84b30 svchost.exe 1812 492 5 101 0 0 2018-01-31 03:48:53 UTC+0000 0xfffffa8003806060 TPAutoConnSvc. 1996 492 9 131 0 0 2018-01-31 03:48:55 UTC+0000 0xfffffa8003e7bb30 WmiPrvSE.exe 1064 604 10 202 0 0 2018-01-31 03:48:58 UTC+0000
0xfffffa8003eae310 dllhost.exe 1488 492 13 189 0 0 2018-01-31 03:48:59 UTC+0000 0xfffffa800274db30 msdtc.exe 1192 492 12 144 0 0 2018-01-31 03:49:01 UTC+0000 0xfffffa80028a15b0 taskhost.exe 2276 492 8 156 1 0 2018-01-31 03:49:17 UTC+0000 0xfffffa80028d5060 dwm.exe 2340 832 5 124 1 0 2018-01-31 03:49:17 UTC+0000 0xfffffa8003f83b30 explorer.exe 2384 2316 32 839 1 0 2018-01-31 03:49:18 UTC+0000 0xfffffa8003f80b30 TPAutoConnect. 2392 1996 3 114 1 0 2018-01-31 03:49:18 UTC+0000 0xfffffa8003f885c0 conhost.exe 2412 388 1 34 1 0 2018-01-31 03:49:18 UTC+0000 0xfffffa800404b1c0 vmtoolsd.exe 2624 2384 5 205 1 0 2018-01-31 03:49:24 UTC+0000 0xfffffa8004732b30 SearchIndexer. 2780 492 13 720 0 0 2018-01-31 03:49:31 UTC+0000 0xfffffa80047971f0 wmpnetwk.exe 2880 492 9 211 0 0 2018-01-31 03:49:33 UTC+0000 0xfffffa800257fb30 svchost.exe 1736 492 14 383 0 0 2018-01-31 03:50:53 UTC+0000 0xfffffa8003b055c0 iexplore.exe 2576 2772 0 -------- 1 0 2018-01-31 03:54:14 UTC+0000 2018-01-31 03:54:33 UTC+0000 0xfffffa8003e35b30 notepad.exe 2664 2576 6 173 1 1 2018-01-31 03:54:30 UTC+0000 0xfffffa8003dc5220 iexplore.exe 2572 2772 0 -------- 1 0 2018-01-31 03:54:33 UTC+0000 2018-01-31 03:54:43 UTC+0000 0xfffffa8003f60060 notepad.exe 1160 2572 4 149 1 1 2018-01-31 03:54:40 UTC+0000 0xfffffa8003af5060 cmd.exe 2840 2664 1 37 1 1 2018-01-31 03:55:05 UTC+0000 0xfffffa8003f4e060 conhost.exe 1476 388 2 50 1 0 2018-01-31 03:55:05 UTC+0000 0xfffffa8003bfc060 notepad.exe 2296 2664 5 94 1 1 2018-01-31 03:55:16 UTC+0000 0xfffffa8003cec3a0 audiodg.exe 2124 796 5 122 0 0 2018-01-31 04:17:59 UTC+0000 0xfffffa800255f460 dd.exe 2524 2840 1 44 1 1 2018-01-31 04:19:14 UTC+0000 0xfffffa8003d27920 FTK Imager.exe 3000 2384 15 357 1 0 2018-01-31 04:19:55 UTC+0000 This Processes list is generatedwith the command: [volatility -f memdump.mem pslist] in Kali Linux Offset(P) Proto Local Address Foreign Address State Pid Owner Created 0x7e470cf0 TCPv4 -:0 136.71.186.3:0 CLOSED 292 svchost.exe 0x7e651010 TCPv4 -:49173 104.16.91.188:80 CLOSED 292 svchost.exe 0x7e9fdcf0 TCPv4 -:49174 192.228.79.201:80 CLOSED 292 svchost.exe 0x7e6837d0 TCPv4 -:49175 192.168.198.254:80 CLOSED 292 svchost.exe 0x7e9697d0 TCPv4 0.0.0.0:135 0.0.0.0:0 LISTENING 708 svchost.exe 0x7e96a880 TCPv4 0.0.0.0:135 0.0.0.0:0 LISTENING 708 svchost.exe 0x7e7642d0 TCPv4 0.0.0.0:445 0.0.0.0:0 LISTENING 4 System 0x7e96a110 TCPv4 0.0.0.0:49152 0.0.0.0:0 LISTENING 396 wininit.exe 0x7e96aef0 TCPv4 0.0.0.0:49152 0.0.0.0:0 LISTENING 396 wininit.exe 0x7e9b3550 TCPv4 0.0.0.0:49153 0.0.0.0:0 LISTENING 796 svchost.exe 0x7e9b4ef0 TCPv4 0.0.0.0:49153 0.0.0.0:0 LISTENING 796 svchost.exe 0x7ec98530 TCPv4 0.0.0.0:49154 0.0.0.0:0 LISTENING 500 lsass.exe 0x7ecc24f0 TCPv4 0.0.0.0:49154 0.0.0.0:0 LISTENING 500 lsass.exe 0x7eca3520 TCPv4 0.0.0.0:49155 0.0.0.0:0 LISTENING 856 svchost.exe 0x7eca42e0 TCPv4 0.0.0.0:49155 0.0.0.0:0 LISTENING 856 svchost.exe 0x7e75f420 TCPv4 0.0.0.0:49156 0.0.0.0:0 LISTENING 492 services.exe
0x7e760240 TCPv4 0.0.0.0:49156 0.0.0.0:0 LISTENING 492 services.exe 0x7e7d39e0 TCPv4 0.0.0.0:49157 0.0.0.0:0 LISTENING 1812 svchost.exe 0x7e7dc010 TCPv4 0.0.0.0:49157 0.0.0.0:0 LISTENING 1812 svchost.exe 0x7ea334a0 TCPv4 0.0.0.0:5357 0.0.0.0:0 LISTENING 4 System 0x7e48b1f0 TCPv4 127.0.0.1:15465 127.0.0.1:49176 ESTABLISHED 2296 notepad.exe 0x7e61d6a0 TCPv4 127.0.0.1:49176 127.0.0.1:15465 ESTABLISHED 2664 notepad.exe 0x7ea0f920 TCPv4 192.168.198.137:139 0.0.0.0:0 LISTENING 4 System 0x7e7e5cf0 TCPv4 192.168.198.137:49169 192.168.198.128:16480 ESTABLISHED 2576 iexplore.exe 0x7e6ac010 TCPv4 192.168.198.137:49172 192.168.198.128:16480 ESTABLISHED 2572 iexplore.exe 0x7e96a880 TCPv6 :::135 :::0 LISTENING 708 svchost.exe 0x7e7642d0 TCPv6 :::445 :::0 LISTENING 4 System 0x7e96a110 TCPv6 :::49152 :::0 LISTENING 396 wininit.exe 0x7e9b3550 TCPv6 :::49153 :::0 LISTENING 796 svchost.exe 0x7ecc24f0 TCPv6 :::49154 :::0 LISTENING 500 lsass.exe 0x7eca3520 TCPv6 :::49155 :::0 LISTENING 856 svchost.exe 0x7e760240 TCPv6 :::49156 :::0 LISTENING 492 services.exe 0x7e7dc010 TCPv6 :::49157 :::0 LISTENING 1812 svchost.exe 0x7ea334a0 TCPv6 :::5357 :::0 LISTENING 4 System 0x7e6833a0 TCPv6 -:445 ff02::16:49177 CLOSED 4 System 0x7e8fc760 TCPv6 -:49177 ff02::16:445 CLOSED 4 System 0x7e7dab50 UDPv4 0.0.0.0:0 *:* 1812 svchost.exe 2018-01-31 03:48:53 UTC+0000 0x7e7dc260 UDPv4 0.0.0.0:0 *:* 1812 svchost.exe 2018-01-31 03:48:53 UTC+0000 0x7ec9a6d0 UDPv4 0.0.0.0:0 *:* 292 svchost.exe 2018-01-31 03:48:39 UTC+0000 0x7ed34520 UDPv4 0.0.0.0:0 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ed41520 UDPv4 0.0.0.0:0 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7e46a910 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7e47d3f0 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7ededb20 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7edfac80 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7ea44160 UDPv4 0.0.0.0:4500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ed42010 UDPv4 0.0.0.0:4500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ea54530 UDPv4 0.0.0.0:500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ed421e0 UDPv4 0.0.0.0:500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ec77370 UDPv4 0.0.0.0:5355 *:* 292 svchost.exe 2018-01-31 04:18:39 UTC+0000 0x7edd1580 UDPv4 0.0.0.0:5355 *:* 292 svchost.exe 2018-01-31 04:18:39 UTC+0000 0x7e9487b0 UDPv4 0.0.0.0:64447 *:* 1300 svchost.exe 2018-01-31 03:48:46 UTC+0000 0x7e6b1840 UDPv4 0.0.0.0:64448 *:* 1300 svchost.exe 2018-01-31 03:48:46 UTC+0000 0x7dae3290 UDPv4 127.0.0.1:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dadc9a0 UDPv4 127.0.0.1:53599 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7ede19b0 UDPv4 192.168.198.137:137 *:* 4 System 2018-01-31 03:48:39 UTC+0000 0x7eddf9b0 UDPv4 192.168.198.137:138 *:* 4 System 2018-01-31 03:48:39 UTC+0000
0x7dae3950 UDPv4 192.168.198.137:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7daddec0 UDPv4 192.168.198.137:53598 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7e7dc260 UDPv6 :::0 *:* 1812 svchost.exe 2018-01-31 03:48:53 UTC+0000 0x7ec9a6d0 UDPv6 :::0 *:* 292 svchost.exe 2018-01-31 03:48:39 UTC+0000 0x7ed34520 UDPv6 :::0 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7e46a910 UDPv6 :::3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7e47d3f0 UDPv6 :::3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7ed42010 UDPv6 :::4500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ea54530 UDPv6 :::500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7edd1580 UDPv6 :::5355 *:* 292 svchost.exe 2018-01-31 04:18:39 UTC+0000 0x7e6b1840 UDPv6 :::64448 *:* 1300 svchost.exe 2018-01-31 03:48:46 UTC+0000 0x7dae3010 UDPv6 ::1:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dadeec0 UDPv6 ::1:53597 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dae1bb0 UDPv6 fe80::a9f7:b885:9ff3:ea5e:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dadf760 UDPv6 fe80::a9f7:b885:9ff3:ea5e:53596 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7f5a5350 UDPv6 fe80::a9f7:b885:9ff3:ea5e:546 *:* 796 svchost.exe 2018-01-31 04:17:06 UTC+0000 This Processes list is generatedwith the command: [volatility -f memdump.mem netscan] in Kali Linux Name Pid PPid Thds Hnds Time -------------------------------------------------- ------ ------ ------ ------ ---- 0xfffffa8003f83b30:explorer.exe 2384 2316 32 839 2018-01-31 03:49:18UTC+0000 . 0xfffffa800404b1c0:vmtoolsd.exe 2624 2384 5 205 2018-01-31 03:49:24UTC+0000 . 0xfffffa8003d27920:FTKImager.exe 3000 2384 15 357 2018-01-31 04:19:55UTC+0000 0xfffffa800373ab30:csrss.exe 388 380 10 296 2018-01-31 03:48:22UTC+0000 . 0xfffffa8003f4e060:conhost.exe 1476 388 2 50 2018-01-31 03:55:05UTC+0000 . 0xfffffa8003f885c0:conhost.exe 2412 388 1 34 2018-01-31 03:49:18UTC+0000 0xfffffa8003751b30:winlogon.exe 432 380 3 108 2018-01-31 03:48:22UTC+0000 0xfffffa8003b055c0:iexplore.exe 2576 2772 0 ------ 2018-01-31 03:54:14UTC+0000 . 0xfffffa8003e35b30:notepad.exe 2664 2576 6 173 2018-01-31 03:54:30UTC+0000 .. 0xfffffa8003af5060:cmd.exe 2840 2664 1 37 2018-01-31 03:55:05UTC+0000 ... 0xfffffa800255f460:dd.exe 2524 2840 1 44 2018-01-31 04:19:14UTC+0000 .. 0xfffffa8003bfc060:notepad.exe 2296 2664 5 94 2018-01-31 03:55:16UTC+0000 0xfffffa8003dc5220:iexplore.exe 2572 2772 0 ------ 2018-01-31 03:54:33UTC+0000 . 0xfffffa8003f60060:notepad.exe 1160 2572 4 149 2018-01-31 03:54:40UTC+0000 0xfffffa8003742b30:wininit.exe 396 328 3 76 2018-01-31 03:48:22UTC+0000 . 0xfffffa80037bb910:services.exe 492 396 7 215 2018-01-31 03:48:25UTC+0000 .. 0xfffffa80036ff060:spoolsv.exe 1112 492 12 323 2018-01-31 03:48:40UTC+0000 .. 0xfffffa80036aa060:svchost.exe 1300 492 16 243 2018-01-31 03:48:43UTC+0000 .. 0xfffffa8003b3f060:vmacthlp.exe 664 492 3 54 2018-01-31 03:48:31UTC+0000 .. 0xfffffa8003b89630:svchost.exe 796 492 18 481 2018-01-31 03:48:33UTC+0000
... 0xfffffa8003cec3a0:audiodg.exe 2124 796 5 122 2018-01-31 04:17:59UTC+0000 .. 0xfffffa8002e83190:ManagementAgen 1548 492 10 92 2018-01-31 03:48:50UTC+0000 .. 0xfffffa8003c3b630:svchost.exe 292 492 14 371 2018-01-31 03:48:38UTC+0000 .. 0xfffffa8004732b30:SearchIndexer. 2780 492 13 720 2018-01-31 03:49:31UTC+0000 .. 0xfffffa8003b9d060:svchost.exe 832 492 17 408 2018-01-31 03:48:34UTC+0000 ... 0xfffffa80028d5060:dwm.exe 2340 832 5 124 2018-01-31 03:49:17UTC+0000 .. 0xfffffa8003b544a0:svchost.exe 708 492 8 274 2018-01-31 03:48:32UTC+0000 .. 0xfffffa800257fb30:svchost.exe 1736 492 14 383 2018-01-31 03:50:53UTC+0000 .. 0xfffffa800383e360:VGAuthService. 1420 492 3 88 2018-01-31 03:48:45UTC+0000 .. 0xfffffa8003806060:TPAutoConnSvc. 1996 492 9 131 2018-01-31 03:48:55UTC+0000 ... 0xfffffa8003f80b30:TPAutoConnect. 2392 1996 3 114 2018-01-31 03:49:18UTC+0000 .. 0xfffffa8003ba4780:svchost.exe 856 492 39 1040 2018-01-31 03:48:34UTC+0000 .. 0xfffffa8003b1c470:svchost.exe 604 492 9 352 2018-01-31 03:48:30UTC+0000 ... 0xfffffa8003e7bb30:WmiPrvSE.exe 1064 604 10 202 2018-01-31 03:48:58UTC+0000 .. 0xfffffa8003eae310:dllhost.exe 1488 492 13 189 2018-01-31 03:48:59UTC+0000 .. 0xfffffa80047971f0:wmpnetwk.exe 2880 492 9 211 2018-01-31 03:49:33UTC+0000 .. 0xfffffa80028a15b0:taskhost.exe 2276 492 8 156 2018-01-31 03:49:17UTC+0000 .. 0xfffffa8003bf6420:svchost.exe 1004 492 10 518 2018-01-31 03:48:36UTC+0000 .. 0xfffffa80027a0b30:vmtoolsd.exe 1520 492 9 291 2018-01-31 03:48:49UTC+0000 .. 0xfffffa800274db30:msdtc.exe 1192 492 12 144 2018-01-31 03:49:01UTC+0000 .. 0xfffffa8003d18b30:svchost.exe 1784 492 6 93 2018-01-31 03:48:53UTC+0000 .. 0xfffffa8003d84b30:svchost.exe 1812 492 5 101 2018-01-31 03:48:53UTC+0000 .. 0xfffffa800370b060:svchost.exe 1148 492 17 308 2018-01-31 03:48:41UTC+0000 . 0xfffffa80037d5b30:lsm.exe 508 396 10 141 2018-01-31 03:48:26UTC+0000 . 0xfffffa80037cf910:lsass.exe 500 396 6 586 2018-01-31 03:48:26UTC+0000 0xfffffa800371cb30:csrss.exe 336 328 9 478 2018-01-31 03:48:21UTC+0000 0xfffffa80024b6740:System 4 0 88 555 2018-01-31 03:48:10UTC+0000 . 0xfffffa8002fd8b30:smss.exe 244 4 2 29 2018-01-31 03:48:10UTC+0000 This Processes Tree list is generatedwith the command: [volatility -f memdump.mem pstree] in Kali Linux. After collectingthose lists, we use Excel 2016 for analyzing, sorting, finding the data. Looking at the Processes list, we see some noticeable process: - 3 processes of notepad.exe - 2 processes of iexplorer.exe o And only two of them has exited time. - 1 process of cmd.exe
- 1 process of FTK Imager.exe - Many of system processes (svhosts.exe) Looking at the Network list, we also see some noticeable connections too: - Most of the connection were made by the system with the source IP: 0.0.0.0 and the destination IP also 0.0.0.0. They are also in the status of LISTENING - There are 4 weirdconnections because their status is ESTABLISHED. Offset(P) Proto Local Address Foreign Address State Pid Owner 0x7e48b1f0 TCPv4 127.0.0.1:15465 127.0.0.1:49176 ESTABLISHED 2296 notepad.exe 0x7e61d6a0 TCPv4 127.0.0.1:49176 127.0.0.1:15465 ESTABLISHED 2664 notepad.exe 0x7e7e5cf0 TCPv4 192.168.198.137:49169 192.168.198.128:16480 ESTABLISHED 2576 iexplore.exe 0x7e6ac010 TCPv4 192.168.198.137:49172 192.168.198.128:16480 ESTABLISHED 2572 iexplore.exe We get into 2 questions: - Why does notepad.exe need to established the connection to loopback address, and two processes seem communicate to each other? - Why does iexplorer.exe connectto the weirdURL with weird port like that (16480)? Normally, people should access to the website via port 80/443. Looking at the Process tree, we see: 0xfffffa8003b055c0:iexplore.exe 2576 2772 0 ------ 2018-01-31 03:54:14UTC+0000 . 0xfffffa8003e35b30:notepad.exe 2664 2576 6 173 2018-01-31 03:54:30UTC+0000 .. 0xfffffa8003af5060:cmd.exe 2840 2664 1 37 2018-01-31 03:55:05UTC+0000 ... 0xfffffa800255f460:dd.exe 2524 2840 1 44 2018-01-31 04:19:14UTC+0000 .. 0xfffffa8003bfc060:notepad.exe 2296 2664 5 94 2018-01-31 03:55:16UTC+0000 0xfffffa8003dc5220:iexplore.exe 2572 2772 0 ------ 2018-01-31 03:54:33UTC+0000 . 0xfffffa8003f60060:notepad.exe 1160 2572 4 149 2018-01-31 03:54:40UTC+0000 - IExplore.exe has many child processes like notepad.exe, cmd.exe and dd.exe. This is truly weird. Conclusion:
From the analysis above, we think that this computer was unauthorized access because of the security problem of InternetExplorer on Windows 7. The attacker might use: - MS11_003_ie_css_importexploit - … We also think that they might use the cmd.exe for their exploringcommand line, and the dd.exe for capturingin the computer.

More Related Content

PDF
Tensorflow and python : fault detection system - PyCon Taiwan 2017
Eric Ahn
 
ODP
Watching And Manipulating Your Network Traffic
Josiah Ritchie
 
PPTX
Finding Evil In DNS Traffic
real_slacker007
 
PDF
OSMC 2015: Linux Performance Profiling and Monitoring by Werner Fischer
NETWAYS
 
TXT
I understand
samaria1
 
TXT
55debug
Edwin Marin
 
ODP
Analysis of Compromised Linux Server
anandvaidya
 
PDF
LISA17 Container Performance Analysis
Brendan Gregg
 
Tensorflow and python : fault detection system - PyCon Taiwan 2017
Eric Ahn
 
Watching And Manipulating Your Network Traffic
Josiah Ritchie
 
Finding Evil In DNS Traffic
real_slacker007
 
OSMC 2015: Linux Performance Profiling and Monitoring by Werner Fischer
NETWAYS
 
I understand
samaria1
 
55debug
Edwin Marin
 
Analysis of Compromised Linux Server
anandvaidya
 
LISA17 Container Performance Analysis
Brendan Gregg
 

Similar to Computer Forensics Report - FRS301 - FPT University (20)

PPT
Honeypots - Tracking the Blackhat Community
amiable_indian
 
PDF
Designing Tracing Tools
Brendan Gregg
 
PDF
Monitoring Containers with Weave Scope
Weaveworks
 
PDF
OSSNA 2017 Performance Analysis Superpowers with Linux BPF
Brendan Gregg
 
PDF
No more dumb hex!
Ange Albertini
 
PDF
bcc/BPF tools - Strategy, current tools, future challenges
IO Visor Project
 
PDF
BPF Tools 2017
Brendan Gregg
 
PDF
Linux 4.x Tracing: Performance Analysis with bcc/BPF
Brendan Gregg
 
PDF
NetConf 2018 BPF Observability
Brendan Gregg
 
PDF
Kernel Recipes 2017 - Performance analysis Superpowers with Linux BPF - Brend...
Anne Nicolas
 
PDF
Kernel Recipes 2017: Performance Analysis with BPF
Brendan Gregg
 
PPTX
Designing Tracing Tools
Sysdig
 
PDF
Linux Systems Performance 2016
Brendan Gregg
 
PDF
OSDC 2017 - Werner Fischer - Linux performance profiling and monitoring
NETWAYS
 
PDF
Как понять, что происходит на сервере? / Александр Крижановский (NatSys Lab.,...
Ontico
 
PDF
Prosess accouting
Torstein Hansen
 
PDF
Fundamentals of Physical Memory Analysis
Dmitry Vostokov
 
PPT
Day2
Jai4uk
 
PDF
M|18 Analytics in the Real World, Case Studies and Use Cases
MariaDB plc
 
PDF
Troubleshooting Tips and Tricks for Database 19c - EMEA Tour Oct 2019
Sandesh Rao
 
Honeypots - Tracking the Blackhat Community
amiable_indian
 
Designing Tracing Tools
Brendan Gregg
 
Monitoring Containers with Weave Scope
Weaveworks
 
OSSNA 2017 Performance Analysis Superpowers with Linux BPF
Brendan Gregg
 
No more dumb hex!
Ange Albertini
 
bcc/BPF tools - Strategy, current tools, future challenges
IO Visor Project
 
BPF Tools 2017
Brendan Gregg
 
Linux 4.x Tracing: Performance Analysis with bcc/BPF
Brendan Gregg
 
NetConf 2018 BPF Observability
Brendan Gregg
 
Kernel Recipes 2017 - Performance analysis Superpowers with Linux BPF - Brend...
Anne Nicolas
 
Kernel Recipes 2017: Performance Analysis with BPF
Brendan Gregg
 
Designing Tracing Tools
Sysdig
 
Linux Systems Performance 2016
Brendan Gregg
 
OSDC 2017 - Werner Fischer - Linux performance profiling and monitoring
NETWAYS
 
Как понять, что происходит на сервере? / Александр Крижановский (NatSys Lab.,...
Ontico
 
Prosess accouting
Torstein Hansen
 
Fundamentals of Physical Memory Analysis
Dmitry Vostokov
 
Day2
Jai4uk
 
M|18 Analytics in the Real World, Case Studies and Use Cases
MariaDB plc
 
Troubleshooting Tips and Tricks for Database 19c - EMEA Tour Oct 2019
Sandesh Rao
 
Ad

More from Duc Lai Trung Minh (20)

PDF
HCMUT IMP Computer Science 20 - E-Government from the view of Privacy
Duc Lai Trung Minh
 
PDF
Vietnam Global Azure Bootcamp 2019 - Security on Azure Kubernetes Services wi...
Duc Lai Trung Minh
 
PDF
21st Meeting - Compare SQL Server and MySQL
Duc Lai Trung Minh
 
PPTX
20190310 - SQL Course - JOIN
Duc Lai Trung Minh
 
PDF
20180922 - 11st meeting - Power BI Module 3 - Part 1
Duc Lai Trung Minh
 
PDF
20180908 - 10th Meeting - Power BI Module 2
Duc Lai Trung Minh
 
PDF
20180901 - 9th Meeting - Power BI Module 0-1
Duc Lai Trung Minh
 
PPTX
20180826 - 8th Meeting - Power BI Orientation
Duc Lai Trung Minh
 
PDF
7th meeting - Analysis Toolpak - Solver - Forecast Worksheet
Duc Lai Trung Minh
 
PDF
Oracle DB 11g R2 Research (Installation, Users and Privileges, Audit Trail, E...
Duc Lai Trung Minh
 
PPTX
20180707 - 2nd meeting - Group Orientation
Duc Lai Trung Minh
 
PPTX
20180701 - 1st Meeting - Data Science Orientation
Duc Lai Trung Minh
 
DOCX
In your opinion, how to avoid communication barriers. Write a short paragraph...
Duc Lai Trung Minh
 
PPTX
[MSPVN - Azure Workshop] Day 2 - Azure Web App and WooCommerce for Online Shop
Duc Lai Trung Minh
 
PPTX
[MSPVN - Azure Workshop] Day 1 - Azure Web App with WordPress deployment
Duc Lai Trung Minh
 
PDF
Duc Lai Trung Minh - Resume - Summer 2017
Duc Lai Trung Minh
 
PDF
[Marketing Arena 2017][First Round] Team SHARP
Duc Lai Trung Minh
 
PPTX
[Privacy and IT Ethics Presentation] Chapter 3: The Forth Amendment and emer...
Duc Lai Trung Minh
 
PPTX
[LSC Training] Tech Training Session
Duc Lai Trung Minh
 
PPTX
[FTU Presentation][KTDN07] Brands
Duc Lai Trung Minh
 
HCMUT IMP Computer Science 20 - E-Government from the view of Privacy
Duc Lai Trung Minh
 
Vietnam Global Azure Bootcamp 2019 - Security on Azure Kubernetes Services wi...
Duc Lai Trung Minh
 
21st Meeting - Compare SQL Server and MySQL
Duc Lai Trung Minh
 
20190310 - SQL Course - JOIN
Duc Lai Trung Minh
 
20180922 - 11st meeting - Power BI Module 3 - Part 1
Duc Lai Trung Minh
 
20180908 - 10th Meeting - Power BI Module 2
Duc Lai Trung Minh
 
20180901 - 9th Meeting - Power BI Module 0-1
Duc Lai Trung Minh
 
20180826 - 8th Meeting - Power BI Orientation
Duc Lai Trung Minh
 
7th meeting - Analysis Toolpak - Solver - Forecast Worksheet
Duc Lai Trung Minh
 
Oracle DB 11g R2 Research (Installation, Users and Privileges, Audit Trail, E...
Duc Lai Trung Minh
 
20180707 - 2nd meeting - Group Orientation
Duc Lai Trung Minh
 
20180701 - 1st Meeting - Data Science Orientation
Duc Lai Trung Minh
 
In your opinion, how to avoid communication barriers. Write a short paragraph...
Duc Lai Trung Minh
 
[MSPVN - Azure Workshop] Day 2 - Azure Web App and WooCommerce for Online Shop
Duc Lai Trung Minh
 
[MSPVN - Azure Workshop] Day 1 - Azure Web App with WordPress deployment
Duc Lai Trung Minh
 
Duc Lai Trung Minh - Resume - Summer 2017
Duc Lai Trung Minh
 
[Marketing Arena 2017][First Round] Team SHARP
Duc Lai Trung Minh
 
[Privacy and IT Ethics Presentation] Chapter 3: The Forth Amendment and emer...
Duc Lai Trung Minh
 
[LSC Training] Tech Training Session
Duc Lai Trung Minh
 
[FTU Presentation][KTDN07] Brands
Duc Lai Trung Minh
 
Ad

Recently uploaded (20)

PDF
Getting Started with Data Integration: FME Form 101
Safe Software
 
PDF
Univ-Connecticut-ChatGPT-Presentaion.pdf
ry7r52mzb4
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
PDF
Encapsulation theory and applications.pdf
gurumoop
 
PDF
1 - Historical Antecedents, Social Consideration.pdf
tuazon2030627
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
PDF
Heart disease approach using modified random forest and particle swarm optimi...
IAESIJAI
 
PDF
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PPTX
TLE Review Electricity (Electricity).pptx
JayPolicarpio2
 
PPTX
cloud_computing_Infrastucture_as_cloud_p
mainakbhattacharya20
 
PDF
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
IAESIJAI
 
PDF
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
PPTX
TechTalks-8-2019-Service-Management-ITIL-Refresh-ITIL-4-Framework-Supports-Ou...
bonakiduza1024
 
PDF
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
PDF
DASA ADMISSION 2024_FirstRound_FirstRank_LastRank.pdf
rameswartudu05
 
PDF
Hindi spoken digit analysis for native and non-native speakers
IAESIJAI
 
PDF
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 
Getting Started with Data Integration: FME Form 101
Safe Software
 
Univ-Connecticut-ChatGPT-Presentaion.pdf
ry7r52mzb4
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Encapsulation theory and applications.pdf
gurumoop
 
1 - Historical Antecedents, Social Consideration.pdf
tuazon2030627
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Accuracy of neural networks in brain wave diagnosis of schizophrenia
IAESIJAI
 
Heart disease approach using modified random forest and particle swarm optimi...
IAESIJAI
 
Mushroom cultivation and it's methods.pdf
mailmeonrishi
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
TLE Review Electricity (Electricity).pptx
JayPolicarpio2
 
cloud_computing_Infrastucture_as_cloud_p
mainakbhattacharya20
 
Video forgery: An extensive analysis of inter-and intra-frame manipulation al...
IAESIJAI
 
Transform Your ITIL® 4 & ITSM Strategy with AI in 2025.pdf
PDCA Consulting
 
TechTalks-8-2019-Service-Management-ITIL-Refresh-ITIL-4-Framework-Supports-Ou...
bonakiduza1024
 
ENT215_Completing-a-large-scale-migration-and-modernization-with-AWS.pdf
ssuser28425f
 
DASA ADMISSION 2024_FirstRound_FirstRank_LastRank.pdf
rameswartudu05
 
Hindi spoken digit analysis for native and non-native speakers
IAESIJAI
 
Profit Center Accounting in SAP S/4HANA, S4F28 Col11
Libreria ERP
 

Computer Forensics Report - FRS301 - FPT University

  • 1. Computer Forensics Report Team IA1161 Evidence Collector: Hoang Dinh Tuan Investigator: Dao Nguyen Van Thanh, Lai Trung Minh Duc Reporter: Lai Trung Minh Duc, Tran Long Nhat Phuong 01/02/18
  • 2. Investigator Information The following report was conducted by Team IA1161 in the following process: - Tuan is the evidence collector who received captured images from Team IA1064 and presented to our investigator to deliver facts that would seem relevant to the case. The evidence is verified to be unaltered. - Thanh is our main investigator who is responsible for taking the evidence and doing necessary tasks to pursue the investigation. His investigation process will be given details in the third section of this report. - Duc and Phuong are in charge of writing this report based on the results from Thanh. Case Description In this project, we are given two image files capturing a suspected machine from Team IA1164: - Disk.001 – HDD captured image - Memdump.mem – RAM capturedimage We suspected that this machine might be attacked by Metasploit’s Payload for unauthorizedaccess. We also tried to restore any deleted files for further relevantdeduction. Computer and Forensic Tool Statistics The two files were collected at 01/02/18 8:27:03 AM when Tuan received them from Team IA1164. Team IA1161 then started given responsibilities to each member, once we settled and understood our missions, we began the research andtesting. The files were tested usingVolatilityprovided by a Kali machine and FTK Imager on Windows 7. These programs have been proven
  • 3. by Mr. Nguyen Sieu Dang to provide valid and accurate results when scanningand analyzinga system.
  • 4. Investigation: 1. Check hash of file to ensure the file haven’t been altered. 2. Investigate HDD to explore any deleted file As we can see, inside the investigatedHDD, we have several files. The noticeable point here are two deleted file. - 8498069.pdf was modified at 1/21/2018 10:06:57 AM - VTP-Challenge VTP Configuration (1).pka was modified at 1/17/2017 11:29:32 AM Restoring 2 files, what we have here is:
  • 5. 8498069.pdf is the tutorial of lab in CCNA VTP-Challenge VTP Configuration (1).pka is the lab file of CCNA Conclusion: After researchedthe HDD, we don’t find any remarkable point that relevantto our suspect. 3. Investigate RAM. By using the command [volatility -f memdump.mem imageinfo], we think that the OperatingSystem of the suspected machine might be: Windows 7 or Windows Server 2008.
  • 6. Here is some of our tables for Processes list and Network list: Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------ 0xfffffa80024b6740 System 4 0 88 555 ------ 0 2018-01-31 03:48:10 UTC+0000 0xfffffa8002fd8b30 smss.exe 244 4 2 29 ------ 0 2018-01-31 03:48:10 UTC+0000 0xfffffa800371cb30 csrss.exe 336 328 9 478 0 0 2018-01-31 03:48:21 UTC+0000 0xfffffa800373ab30 csrss.exe 388 380 10 296 1 0 2018-01-31 03:48:22 UTC+0000 0xfffffa8003742b30 wininit.exe 396 328 3 76 0 0 2018-01-31 03:48:22 UTC+0000 0xfffffa8003751b30 winlogon.exe 432 380 3 108 1 0 2018-01-31 03:48:22 UTC+0000 0xfffffa80037bb910 services.exe 492 396 7 215 0 0 2018-01-31 03:48:25 UTC+0000 0xfffffa80037cf910 lsass.exe 500 396 6 586 0 0 2018-01-31 03:48:26 UTC+0000 0xfffffa80037d5b30 lsm.exe 508 396 10 141 0 0 2018-01-31 03:48:26 UTC+0000 0xfffffa8003b1c470 svchost.exe 604 492 9 352 0 0 2018-01-31 03:48:30 UTC+0000 0xfffffa8003b3f060 vmacthlp.exe 664 492 3 54 0 0 2018-01-31 03:48:31 UTC+0000 0xfffffa8003b544a0 svchost.exe 708 492 8 274 0 0 2018-01-31 03:48:32 UTC+0000 0xfffffa8003b89630 svchost.exe 796 492 18 481 0 0 2018-01-31 03:48:33 UTC+0000 0xfffffa8003b9d060 svchost.exe 832 492 17 408 0 0 2018-01-31 03:48:34 UTC+0000 0xfffffa8003ba4780 svchost.exe 856 492 39 1040 0 0 2018-01-31 03:48:34 UTC+0000 0xfffffa8003bf6420 svchost.exe 1004 492 10 518 0 0 2018-01-31 03:48:36 UTC+0000 0xfffffa8003c3b630 svchost.exe 292 492 14 371 0 0 2018-01-31 03:48:38 UTC+0000 0xfffffa80036ff060 spoolsv.exe 1112 492 12 323 0 0 2018-01-31 03:48:40 UTC+0000 0xfffffa800370b060 svchost.exe 1148 492 17 308 0 0 2018-01-31 03:48:41 UTC+0000 0xfffffa80036aa060 svchost.exe 1300 492 16 243 0 0 2018-01-31 03:48:43 UTC+0000 0xfffffa800383e360 VGAuthService. 1420 492 3 88 0 0 2018-01-31 03:48:45 UTC+0000 0xfffffa80027a0b30 vmtoolsd.exe 1520 492 9 291 0 0 2018-01-31 03:48:49 UTC+0000 0xfffffa8002e83190 ManagementAgen 1548 492 10 92 0 0 2018-01-31 03:48:50 UTC+0000 0xfffffa8003d18b30 svchost.exe 1784 492 6 93 0 0 2018-01-31 03:48:53 UTC+0000 0xfffffa8003d84b30 svchost.exe 1812 492 5 101 0 0 2018-01-31 03:48:53 UTC+0000 0xfffffa8003806060 TPAutoConnSvc. 1996 492 9 131 0 0 2018-01-31 03:48:55 UTC+0000 0xfffffa8003e7bb30 WmiPrvSE.exe 1064 604 10 202 0 0 2018-01-31 03:48:58 UTC+0000
  • 7. 0xfffffa8003eae310 dllhost.exe 1488 492 13 189 0 0 2018-01-31 03:48:59 UTC+0000 0xfffffa800274db30 msdtc.exe 1192 492 12 144 0 0 2018-01-31 03:49:01 UTC+0000 0xfffffa80028a15b0 taskhost.exe 2276 492 8 156 1 0 2018-01-31 03:49:17 UTC+0000 0xfffffa80028d5060 dwm.exe 2340 832 5 124 1 0 2018-01-31 03:49:17 UTC+0000 0xfffffa8003f83b30 explorer.exe 2384 2316 32 839 1 0 2018-01-31 03:49:18 UTC+0000 0xfffffa8003f80b30 TPAutoConnect. 2392 1996 3 114 1 0 2018-01-31 03:49:18 UTC+0000 0xfffffa8003f885c0 conhost.exe 2412 388 1 34 1 0 2018-01-31 03:49:18 UTC+0000 0xfffffa800404b1c0 vmtoolsd.exe 2624 2384 5 205 1 0 2018-01-31 03:49:24 UTC+0000 0xfffffa8004732b30 SearchIndexer. 2780 492 13 720 0 0 2018-01-31 03:49:31 UTC+0000 0xfffffa80047971f0 wmpnetwk.exe 2880 492 9 211 0 0 2018-01-31 03:49:33 UTC+0000 0xfffffa800257fb30 svchost.exe 1736 492 14 383 0 0 2018-01-31 03:50:53 UTC+0000 0xfffffa8003b055c0 iexplore.exe 2576 2772 0 -------- 1 0 2018-01-31 03:54:14 UTC+0000 2018-01-31 03:54:33 UTC+0000 0xfffffa8003e35b30 notepad.exe 2664 2576 6 173 1 1 2018-01-31 03:54:30 UTC+0000 0xfffffa8003dc5220 iexplore.exe 2572 2772 0 -------- 1 0 2018-01-31 03:54:33 UTC+0000 2018-01-31 03:54:43 UTC+0000 0xfffffa8003f60060 notepad.exe 1160 2572 4 149 1 1 2018-01-31 03:54:40 UTC+0000 0xfffffa8003af5060 cmd.exe 2840 2664 1 37 1 1 2018-01-31 03:55:05 UTC+0000 0xfffffa8003f4e060 conhost.exe 1476 388 2 50 1 0 2018-01-31 03:55:05 UTC+0000 0xfffffa8003bfc060 notepad.exe 2296 2664 5 94 1 1 2018-01-31 03:55:16 UTC+0000 0xfffffa8003cec3a0 audiodg.exe 2124 796 5 122 0 0 2018-01-31 04:17:59 UTC+0000 0xfffffa800255f460 dd.exe 2524 2840 1 44 1 1 2018-01-31 04:19:14 UTC+0000 0xfffffa8003d27920 FTK Imager.exe 3000 2384 15 357 1 0 2018-01-31 04:19:55 UTC+0000 This Processes list is generatedwith the command: [volatility -f memdump.mem pslist] in Kali Linux Offset(P) Proto Local Address Foreign Address State Pid Owner Created 0x7e470cf0 TCPv4 -:0 136.71.186.3:0 CLOSED 292 svchost.exe 0x7e651010 TCPv4 -:49173 104.16.91.188:80 CLOSED 292 svchost.exe 0x7e9fdcf0 TCPv4 -:49174 192.228.79.201:80 CLOSED 292 svchost.exe 0x7e6837d0 TCPv4 -:49175 192.168.198.254:80 CLOSED 292 svchost.exe 0x7e9697d0 TCPv4 0.0.0.0:135 0.0.0.0:0 LISTENING 708 svchost.exe 0x7e96a880 TCPv4 0.0.0.0:135 0.0.0.0:0 LISTENING 708 svchost.exe 0x7e7642d0 TCPv4 0.0.0.0:445 0.0.0.0:0 LISTENING 4 System 0x7e96a110 TCPv4 0.0.0.0:49152 0.0.0.0:0 LISTENING 396 wininit.exe 0x7e96aef0 TCPv4 0.0.0.0:49152 0.0.0.0:0 LISTENING 396 wininit.exe 0x7e9b3550 TCPv4 0.0.0.0:49153 0.0.0.0:0 LISTENING 796 svchost.exe 0x7e9b4ef0 TCPv4 0.0.0.0:49153 0.0.0.0:0 LISTENING 796 svchost.exe 0x7ec98530 TCPv4 0.0.0.0:49154 0.0.0.0:0 LISTENING 500 lsass.exe 0x7ecc24f0 TCPv4 0.0.0.0:49154 0.0.0.0:0 LISTENING 500 lsass.exe 0x7eca3520 TCPv4 0.0.0.0:49155 0.0.0.0:0 LISTENING 856 svchost.exe 0x7eca42e0 TCPv4 0.0.0.0:49155 0.0.0.0:0 LISTENING 856 svchost.exe 0x7e75f420 TCPv4 0.0.0.0:49156 0.0.0.0:0 LISTENING 492 services.exe
  • 8. 0x7e760240 TCPv4 0.0.0.0:49156 0.0.0.0:0 LISTENING 492 services.exe 0x7e7d39e0 TCPv4 0.0.0.0:49157 0.0.0.0:0 LISTENING 1812 svchost.exe 0x7e7dc010 TCPv4 0.0.0.0:49157 0.0.0.0:0 LISTENING 1812 svchost.exe 0x7ea334a0 TCPv4 0.0.0.0:5357 0.0.0.0:0 LISTENING 4 System 0x7e48b1f0 TCPv4 127.0.0.1:15465 127.0.0.1:49176 ESTABLISHED 2296 notepad.exe 0x7e61d6a0 TCPv4 127.0.0.1:49176 127.0.0.1:15465 ESTABLISHED 2664 notepad.exe 0x7ea0f920 TCPv4 192.168.198.137:139 0.0.0.0:0 LISTENING 4 System 0x7e7e5cf0 TCPv4 192.168.198.137:49169 192.168.198.128:16480 ESTABLISHED 2576 iexplore.exe 0x7e6ac010 TCPv4 192.168.198.137:49172 192.168.198.128:16480 ESTABLISHED 2572 iexplore.exe 0x7e96a880 TCPv6 :::135 :::0 LISTENING 708 svchost.exe 0x7e7642d0 TCPv6 :::445 :::0 LISTENING 4 System 0x7e96a110 TCPv6 :::49152 :::0 LISTENING 396 wininit.exe 0x7e9b3550 TCPv6 :::49153 :::0 LISTENING 796 svchost.exe 0x7ecc24f0 TCPv6 :::49154 :::0 LISTENING 500 lsass.exe 0x7eca3520 TCPv6 :::49155 :::0 LISTENING 856 svchost.exe 0x7e760240 TCPv6 :::49156 :::0 LISTENING 492 services.exe 0x7e7dc010 TCPv6 :::49157 :::0 LISTENING 1812 svchost.exe 0x7ea334a0 TCPv6 :::5357 :::0 LISTENING 4 System 0x7e6833a0 TCPv6 -:445 ff02::16:49177 CLOSED 4 System 0x7e8fc760 TCPv6 -:49177 ff02::16:445 CLOSED 4 System 0x7e7dab50 UDPv4 0.0.0.0:0 *:* 1812 svchost.exe 2018-01-31 03:48:53 UTC+0000 0x7e7dc260 UDPv4 0.0.0.0:0 *:* 1812 svchost.exe 2018-01-31 03:48:53 UTC+0000 0x7ec9a6d0 UDPv4 0.0.0.0:0 *:* 292 svchost.exe 2018-01-31 03:48:39 UTC+0000 0x7ed34520 UDPv4 0.0.0.0:0 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ed41520 UDPv4 0.0.0.0:0 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7e46a910 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7e47d3f0 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7ededb20 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7edfac80 UDPv4 0.0.0.0:3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7ea44160 UDPv4 0.0.0.0:4500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ed42010 UDPv4 0.0.0.0:4500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ea54530 UDPv4 0.0.0.0:500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ed421e0 UDPv4 0.0.0.0:500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ec77370 UDPv4 0.0.0.0:5355 *:* 292 svchost.exe 2018-01-31 04:18:39 UTC+0000 0x7edd1580 UDPv4 0.0.0.0:5355 *:* 292 svchost.exe 2018-01-31 04:18:39 UTC+0000 0x7e9487b0 UDPv4 0.0.0.0:64447 *:* 1300 svchost.exe 2018-01-31 03:48:46 UTC+0000 0x7e6b1840 UDPv4 0.0.0.0:64448 *:* 1300 svchost.exe 2018-01-31 03:48:46 UTC+0000 0x7dae3290 UDPv4 127.0.0.1:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dadc9a0 UDPv4 127.0.0.1:53599 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7ede19b0 UDPv4 192.168.198.137:137 *:* 4 System 2018-01-31 03:48:39 UTC+0000 0x7eddf9b0 UDPv4 192.168.198.137:138 *:* 4 System 2018-01-31 03:48:39 UTC+0000
  • 9. 0x7dae3950 UDPv4 192.168.198.137:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7daddec0 UDPv4 192.168.198.137:53598 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7e7dc260 UDPv6 :::0 *:* 1812 svchost.exe 2018-01-31 03:48:53 UTC+0000 0x7ec9a6d0 UDPv6 :::0 *:* 292 svchost.exe 2018-01-31 03:48:39 UTC+0000 0x7ed34520 UDPv6 :::0 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7e46a910 UDPv6 :::3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7e47d3f0 UDPv6 :::3702 *:* 1300 svchost.exe 2018-01-31 03:48:57 UTC+0000 0x7ed42010 UDPv6 :::4500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7ea54530 UDPv6 :::500 *:* 856 svchost.exe 2018-01-31 03:48:44 UTC+0000 0x7edd1580 UDPv6 :::5355 *:* 292 svchost.exe 2018-01-31 04:18:39 UTC+0000 0x7e6b1840 UDPv6 :::64448 *:* 1300 svchost.exe 2018-01-31 03:48:46 UTC+0000 0x7dae3010 UDPv6 ::1:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dadeec0 UDPv6 ::1:53597 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dae1bb0 UDPv6 fe80::a9f7:b885:9ff3:ea5e:1900 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7dadf760 UDPv6 fe80::a9f7:b885:9ff3:ea5e:53596 *:* 1300 svchost.exe 2018-01-31 03:49:50 UTC+0000 0x7f5a5350 UDPv6 fe80::a9f7:b885:9ff3:ea5e:546 *:* 796 svchost.exe 2018-01-31 04:17:06 UTC+0000 This Processes list is generatedwith the command: [volatility -f memdump.mem netscan] in Kali Linux Name Pid PPid Thds Hnds Time -------------------------------------------------- ------ ------ ------ ------ ---- 0xfffffa8003f83b30:explorer.exe 2384 2316 32 839 2018-01-31 03:49:18UTC+0000 . 0xfffffa800404b1c0:vmtoolsd.exe 2624 2384 5 205 2018-01-31 03:49:24UTC+0000 . 0xfffffa8003d27920:FTKImager.exe 3000 2384 15 357 2018-01-31 04:19:55UTC+0000 0xfffffa800373ab30:csrss.exe 388 380 10 296 2018-01-31 03:48:22UTC+0000 . 0xfffffa8003f4e060:conhost.exe 1476 388 2 50 2018-01-31 03:55:05UTC+0000 . 0xfffffa8003f885c0:conhost.exe 2412 388 1 34 2018-01-31 03:49:18UTC+0000 0xfffffa8003751b30:winlogon.exe 432 380 3 108 2018-01-31 03:48:22UTC+0000 0xfffffa8003b055c0:iexplore.exe 2576 2772 0 ------ 2018-01-31 03:54:14UTC+0000 . 0xfffffa8003e35b30:notepad.exe 2664 2576 6 173 2018-01-31 03:54:30UTC+0000 .. 0xfffffa8003af5060:cmd.exe 2840 2664 1 37 2018-01-31 03:55:05UTC+0000 ... 0xfffffa800255f460:dd.exe 2524 2840 1 44 2018-01-31 04:19:14UTC+0000 .. 0xfffffa8003bfc060:notepad.exe 2296 2664 5 94 2018-01-31 03:55:16UTC+0000 0xfffffa8003dc5220:iexplore.exe 2572 2772 0 ------ 2018-01-31 03:54:33UTC+0000 . 0xfffffa8003f60060:notepad.exe 1160 2572 4 149 2018-01-31 03:54:40UTC+0000 0xfffffa8003742b30:wininit.exe 396 328 3 76 2018-01-31 03:48:22UTC+0000 . 0xfffffa80037bb910:services.exe 492 396 7 215 2018-01-31 03:48:25UTC+0000 .. 0xfffffa80036ff060:spoolsv.exe 1112 492 12 323 2018-01-31 03:48:40UTC+0000 .. 0xfffffa80036aa060:svchost.exe 1300 492 16 243 2018-01-31 03:48:43UTC+0000 .. 0xfffffa8003b3f060:vmacthlp.exe 664 492 3 54 2018-01-31 03:48:31UTC+0000 .. 0xfffffa8003b89630:svchost.exe 796 492 18 481 2018-01-31 03:48:33UTC+0000
  • 10. ... 0xfffffa8003cec3a0:audiodg.exe 2124 796 5 122 2018-01-31 04:17:59UTC+0000 .. 0xfffffa8002e83190:ManagementAgen 1548 492 10 92 2018-01-31 03:48:50UTC+0000 .. 0xfffffa8003c3b630:svchost.exe 292 492 14 371 2018-01-31 03:48:38UTC+0000 .. 0xfffffa8004732b30:SearchIndexer. 2780 492 13 720 2018-01-31 03:49:31UTC+0000 .. 0xfffffa8003b9d060:svchost.exe 832 492 17 408 2018-01-31 03:48:34UTC+0000 ... 0xfffffa80028d5060:dwm.exe 2340 832 5 124 2018-01-31 03:49:17UTC+0000 .. 0xfffffa8003b544a0:svchost.exe 708 492 8 274 2018-01-31 03:48:32UTC+0000 .. 0xfffffa800257fb30:svchost.exe 1736 492 14 383 2018-01-31 03:50:53UTC+0000 .. 0xfffffa800383e360:VGAuthService. 1420 492 3 88 2018-01-31 03:48:45UTC+0000 .. 0xfffffa8003806060:TPAutoConnSvc. 1996 492 9 131 2018-01-31 03:48:55UTC+0000 ... 0xfffffa8003f80b30:TPAutoConnect. 2392 1996 3 114 2018-01-31 03:49:18UTC+0000 .. 0xfffffa8003ba4780:svchost.exe 856 492 39 1040 2018-01-31 03:48:34UTC+0000 .. 0xfffffa8003b1c470:svchost.exe 604 492 9 352 2018-01-31 03:48:30UTC+0000 ... 0xfffffa8003e7bb30:WmiPrvSE.exe 1064 604 10 202 2018-01-31 03:48:58UTC+0000 .. 0xfffffa8003eae310:dllhost.exe 1488 492 13 189 2018-01-31 03:48:59UTC+0000 .. 0xfffffa80047971f0:wmpnetwk.exe 2880 492 9 211 2018-01-31 03:49:33UTC+0000 .. 0xfffffa80028a15b0:taskhost.exe 2276 492 8 156 2018-01-31 03:49:17UTC+0000 .. 0xfffffa8003bf6420:svchost.exe 1004 492 10 518 2018-01-31 03:48:36UTC+0000 .. 0xfffffa80027a0b30:vmtoolsd.exe 1520 492 9 291 2018-01-31 03:48:49UTC+0000 .. 0xfffffa800274db30:msdtc.exe 1192 492 12 144 2018-01-31 03:49:01UTC+0000 .. 0xfffffa8003d18b30:svchost.exe 1784 492 6 93 2018-01-31 03:48:53UTC+0000 .. 0xfffffa8003d84b30:svchost.exe 1812 492 5 101 2018-01-31 03:48:53UTC+0000 .. 0xfffffa800370b060:svchost.exe 1148 492 17 308 2018-01-31 03:48:41UTC+0000 . 0xfffffa80037d5b30:lsm.exe 508 396 10 141 2018-01-31 03:48:26UTC+0000 . 0xfffffa80037cf910:lsass.exe 500 396 6 586 2018-01-31 03:48:26UTC+0000 0xfffffa800371cb30:csrss.exe 336 328 9 478 2018-01-31 03:48:21UTC+0000 0xfffffa80024b6740:System 4 0 88 555 2018-01-31 03:48:10UTC+0000 . 0xfffffa8002fd8b30:smss.exe 244 4 2 29 2018-01-31 03:48:10UTC+0000 This Processes Tree list is generatedwith the command: [volatility -f memdump.mem pstree] in Kali Linux. After collectingthose lists, we use Excel 2016 for analyzing, sorting, finding the data. Looking at the Processes list, we see some noticeable process: - 3 processes of notepad.exe - 2 processes of iexplorer.exe o And only two of them has exited time. - 1 process of cmd.exe
  • 11. - 1 process of FTK Imager.exe - Many of system processes (svhosts.exe) Looking at the Network list, we also see some noticeable connections too: - Most of the connection were made by the system with the source IP: 0.0.0.0 and the destination IP also 0.0.0.0. They are also in the status of LISTENING - There are 4 weirdconnections because their status is ESTABLISHED. Offset(P) Proto Local Address Foreign Address State Pid Owner 0x7e48b1f0 TCPv4 127.0.0.1:15465 127.0.0.1:49176 ESTABLISHED 2296 notepad.exe 0x7e61d6a0 TCPv4 127.0.0.1:49176 127.0.0.1:15465 ESTABLISHED 2664 notepad.exe 0x7e7e5cf0 TCPv4 192.168.198.137:49169 192.168.198.128:16480 ESTABLISHED 2576 iexplore.exe 0x7e6ac010 TCPv4 192.168.198.137:49172 192.168.198.128:16480 ESTABLISHED 2572 iexplore.exe We get into 2 questions: - Why does notepad.exe need to established the connection to loopback address, and two processes seem communicate to each other? - Why does iexplorer.exe connectto the weirdURL with weird port like that (16480)? Normally, people should access to the website via port 80/443. Looking at the Process tree, we see: 0xfffffa8003b055c0:iexplore.exe 2576 2772 0 ------ 2018-01-31 03:54:14UTC+0000 . 0xfffffa8003e35b30:notepad.exe 2664 2576 6 173 2018-01-31 03:54:30UTC+0000 .. 0xfffffa8003af5060:cmd.exe 2840 2664 1 37 2018-01-31 03:55:05UTC+0000 ... 0xfffffa800255f460:dd.exe 2524 2840 1 44 2018-01-31 04:19:14UTC+0000 .. 0xfffffa8003bfc060:notepad.exe 2296 2664 5 94 2018-01-31 03:55:16UTC+0000 0xfffffa8003dc5220:iexplore.exe 2572 2772 0 ------ 2018-01-31 03:54:33UTC+0000 . 0xfffffa8003f60060:notepad.exe 1160 2572 4 149 2018-01-31 03:54:40UTC+0000 - IExplore.exe has many child processes like notepad.exe, cmd.exe and dd.exe. This is truly weird. Conclusion:
  • 12. From the analysis above, we think that this computer was unauthorized access because of the security problem of InternetExplorer on Windows 7. The attacker might use: - MS11_003_ie_css_importexploit - … We also think that they might use the cmd.exe for their exploringcommand line, and the dd.exe for capturingin the computer.