Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

GCFA > Memory Forensics in Incident Response > Flashcards

Memory Forensics in Incident Response Flashcards

1
Q

When did the change from rudimentary string searching to recovering process information in memory forensics?

A

The DFRWS 2005 challenge.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

At what event did many professionals agree that “pulling the plug” is no longer acceptable?

A

The SANS Forensics Summit in 2008. (p8)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Why do some guides still recommend pulling the plug instead of performing memory forensics?

A

A lot of the guides are distributed to people with absolutely no computer training (law enforcement).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Why are memory forensics important?

A

Nearly everything of interest traverses RAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Why is memory becoming less volatile and more like a secondary file system?

A

It’s becoming larger.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are volatile registry keys?

A

Registry keys that can be updated and only survive in memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

p12 needed?

A

?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is \Device\PhysicalMemory?

A

A handle in the Windows filesystem that, prior to Windows 2003 SP1, could be used to address and copy physical memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When did \Device\PhysicalMemory go away?

A

Windows 2003 SP1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is HIPS?

A

Host Intrusion Protection Software

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When do Windows drivers have to be signed?

A

64 bit systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you access physical memory on Windows systems?

A

Pre 2003 SP1, \Devices\PhysicalMemory. Post 2003 SP1 requires a driver.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is WinPMEM?

A

A memory dumping tool for Windows. It allows read only or read write access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Redline?

A

A tool that is used for Windows memory analysis. Can also perform live memory analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can you perform memory analysis on a system that’s already been shut down?

A

Copies of ram that are automatically created, like hibernation files in Windows. Crash dump files as well.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the filename that Windows uses to create a copy of memory when the system goes into hibernation?

A

hiberfil.sys

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What portions of memory are included in hiberfil.sys?

A

Everything. It’s a complete copy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a Windows crash dump file named?

A

memory.dmp in %WINDIR%. If it’s a full crash dump, it’ll be a complete copy of memory. (See footnotes on p14)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why is analysis of chat applications difficult?

A

Many don’t log communications to disk, so the only place to find the information may be in memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is DumpIt?

A

A simple memory dumping tool from MoonSols that dumps memory from 32 or 64 bit Windows systems to the curent working directory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where’s the best place to run DumpIt.exe?

A

A large capacity thumb drive, because it dumpts to CWD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What does DumpIt cost?

A

It’s free.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How is memory usually stored on disk with virtualization products?

A

It’s often a raw copy of memory, so can be analyzed with standard memory analysis tools.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In which virtualization products is the on-disk memory image a copy of raw memory?

A

VMWare, Microsoft Server 2008 Hyper-V, and Parallels.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How is the on-disk memory image for VirtualBox different from most other virtualization products?

A

It only holds memory in use, not a complete image of memory. (16)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the fallback plan to analyze memory on a virtual machine if the on-disk image analysis won’t work?

A

Run a memory acquisition tool within the virtual guest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What product can be used to analyze virtualization product memory?

A

Volatility

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What are the common file suffixed for virtual memory files?

A 
.vmem - VMware raw memory
.vmss - VMware contains memory image
.vmsn - VMware contains memory image
.bin - Microsoft Hyper-v memory image
.vsv - Microsoft Hyper-v save state
.mem - Parallels raw memory image
.sav - VirtualBox partial memory image
(16)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Where are memory images found?

A

p16.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Rajid Mitra case

A

p18

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is hiberfil.sys?

A

A Windows hibernation file a compressed copy of RAM at the time of hibernation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How can you decompress hiberfil.sys?

A

Volatility’s imagecopy or MoonSols hibr2bin.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What files can analyze Windows hibernation files natively?

A

BulkExtractor
Magnet Forensics Internet Evidence Finder
Volatility
Belkasoft Evidence Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What windows command line tool manages hibernation files?

A

powercfg.exe (review the options p 20)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is memory forensics?

A

Study of data captured from memory of a target system, including RAM and virtual memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

How is memory analysis different from traditional media forensics?

A
  • Data is a snapshot in time, with dramatic changes possible moment to moment
  • Complicated to establish context because there’s more information than just files and directories
  • Data is formatted for execution, not to be extracted and understood, so analysis is more complicated.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How is memory analysis similar to media forensics?

A
  • Still requires forensically clean procedure
  • Still requires putting memory in context, but memory has a more complicated architecture than disk filesystems.
  • Still requires analyzing the raw results to understand what the data means
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Why is forensic capture of memory more complicated than of media?

A

Executing a program to capture memory modifies memory.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is the KDBG?

A

Kernel Debugger Datablock (lots more on p.24)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the three traditional malware detection methods?

A

Signature, contradiction, heuristic/behavioral (26)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What are the processes to find the first hit in memory analysis?

A
  1. Identify rogue processes
  2. Analyze process DLLs and handles
  3. Review network artifacts
  4. Look for evidence of code injection
  5. Check for rootkit signature
  6. Dump suspicious processes and drivers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Redline

A

p. 27-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

EPROCESS blocks

A

p. 35-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Analyzing processes

A

p. 37

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

How does Redline identify rogue processes?

A

p. 40-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What is MRI?

A

Malware Risk Index. (42)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What are the two components in MRI?

A
  1. Behavior rule set

2. Verification of digital signatures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

What are the three types of rules in the behavior rule set?

A
  1. Process path verification
  2. Process user verification
  3. Process Handle Inspection (does a process like svchost have a handle to cmd.exe?)
  4. DLL load order issues (evidence of DLL hijacking)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

What is required for Redline digital signature checking?

A

It can only be done in live memory analysis.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

What other things does Redline check for?

A

1) Unmapped processes
2) Processes started by command shell
3) DLL load order/hijacking
4) Expected command line arguments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Redline heirarchical process view?

A

p48

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

HBGary Responder product?

A

p48

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

What things should you check all processes for?

A

1) Correct image/executable names
2) Correct file location (path)
3) Correct parent process
4) Correct command line and parameters
5) Start time information
6) Security identifies (SID)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

What is the Windows per-process limit on kernel handles?

A

2^24 (52)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is a handle in windows?

A

A pointer to a resource such a file directory registry key, mutex or semaphore, or event.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

What are the components of a process in Windows?

A

DLLs, handles, threads, memory sections sockets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

What is a VAD?

A

In Windows, it’s a Virtual Address Descriptor tree and maintains a list of assigned memory sections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

What is a socket?

A

A network connection endpoint.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What process does Conflicker/Kido inject itself into?

A

svchost.exe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

How can you detect Conflicker/Kido?

A

Only by looking at process objects. Because it uses injection into svchost.exe, SID, launch time, path, and parent process are normal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

What is Least Frequency of Occurrence?

A

The principle that anything related to malware should be uncommon on a system or enterprise. Sorting a list based on occurrences and looking at the least frequently occuring items can be useful. (56)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

If an object appears in one process, what does that mean?

A

It might be a sign of malice, but not always. There are legitimate objects that only appear in one windows process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

How many signatures does Redline ship with?

A

Less than 50, but you can create your own.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Poison Ivy Remote Access tool?

A

(62)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Creating redline signatures?

A

(62)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

List network artifacts

A
  • suspicious ports
  • suspicious connections
  • suspicious processes (should it be communicating over the network at all?)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

What are some examples of unusual network behavior?

A

A non-browser communicating over port 80/443/8080
A browser communicating over a port other than 80/443/8080.
Connections to unexplained IP addresses
Web requests directly to an IP
RDP connections (3389) particularly from odd IPs.
DNS requests for unusual names

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

How are RDP connections usually managed?

A

They’re usually routed through a VPN concentrator.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

What is TDL3/TDSS?

A

(69)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

Redline memory string analysis

A

(71)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

What things should you search for in memory?

A

Known bad IPs, domains, or filenames. http://, https://, ftp:/.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Zeus

A

(71)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
73
Q

How common is DLL injection in modern malware?

A

Very common.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
74
Q

How does DLL injection work?

A

Allocate space in a running process, shove the DLL into it, create a new thread to load the DLL into the process.

or

Hook a process’s filter functions using SetWindowsHookEx().

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
75
Q

How do you load a DLL into a running process?

A

VirtualAllocEx()

CreateRemoteThread()

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
76
Q

What is the symptom of DLL injection?

A

An unnamed memory section containing executable code attached to a victim process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
77
Q

What is process hollowing?

A

Start a copy of a legitimate system process, pause the process, de-allocate some of the original code and replace it with malicious code.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
78
Q

What is the advantage of process hollowing?

A

It retains the original executable’s process image name, path, and command line. Camouflage.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
79
Q

How is a memory page marked executable?

A

Page_Execute_ReadWrite (72)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
80
Q

What does it mean for a memory page to be unmapped?

A

It’s not backed by a file on disk.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
81
Q

How do you identify process hollowing?

A

If the image binary is not backed by a file on disk (unmapped), it’s a strong indicator of process hollowing. (77)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
82
Q

Zeus

A

(78-9)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
83
Q

Stuxnet

A

(83-5)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
84
Q

Process hollowing example

A

(83-5)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
85
Q

Why have malware authors resorted to techniques like hiding in plain sight?

A

More advanced techniques like code injection are easy to find with memory analysis, and tools like Redline makes it easy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
86
Q

How do most rootkits work?

A

By hooking legitimate system functions and redirecting output.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
87
Q

What is SSDT?

A

The System Service Descriptor Table (89)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
88
Q

What is IDT?

A

(89)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
89
Q

What is IAT?

A

(90)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
90
Q

What is IRP?

A

(90)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
91
Q

Storm/SSDT hooking

A

(91)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
92
Q

Commonly hooked functions?

A

NtEnumerateKey
NtEnumerateValueKey
NtQueryDirectoryFile
(91(

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
93
Q

Why is it hard to identify malicious I/O Request Packet hooks?

A

There are so many legitimate hooks that have to be eliminated first. Lots of 3rd party drivers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
94
Q

What is a good method to identify malicious I/O Request Packet hooks?

A

Least Frequency of Occurrence. Most malware hooks sparingly and may hook functions that no or few other applications do.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
95
Q

What is the Storm Worm?

A

A spam bot.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
96
Q

How does Storm hide network activity?

A

It hooks IRP_MJ_DEVICE_CONTROL function within tcpip.sys.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
97
Q

openports?

A

93

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
98
Q

What does a rootkit do?

A

It hides the existence of system object like processes, files, registry keys, and network artifacts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
99
Q

How do you dump a process in Redline?

A

Processes tab in Analysis Data Pane, double click the process of interest within the Table View pane and select MRI Report from the Full Detailed Information tabs at the bottom fo the window. That contains “Acquire Process Address Space”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
100
Q

Where does Redline dump a process memory image?

A

By default %user profile%\AppData\Local\Temp\AgentAcquisition in a password protected zip archive (prevents AV quarantining)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
101
Q

Driver aquisition

A

99

102
Q

What does \??\ indicate?

A

An “extended length path” in Windows. (99)

103
Q

What options exist for analyzing a process and drivers once they’ve been extracted?

A
  • Scan for malware

* Study the assembly code (ugh…)

104
Q

What does virustotal.com do?

A

Scans a file with over 40 different AV engines.

105
Q

Is there a drawback to virustotal.com?

A

Anything you upload is public domain. A safer option is to upload a MD5 of the suspect file.

106
Q

List free, automated tools for examining extracted binaries.

A

Threat Expert and GFI Sandbox.

107
Q

What are the benefits of live memory analysis?

A
  • Faster triage
  • Includes the system pagefile
  • More accurate heuristic matching
  • Digital signature checks of process executables, DLLs, drivers with a known good whitelist
  • Indicator of Compromise searches using pre-defined IOC files.
108
Q

Why is live analysis effective at defeating advanced malware?

A

It accesses physical memory, not relying on API calls, open handles, or debuggers.

109
Q

What is Shadow Walker?

A

Proof of concept code that pages itself out of memory when a memory acquisition tool is detected. (107)

110
Q

107 last para

A

x

111
Q

p 108-118

A

x

112
Q

What is Volatility?

A

A framework for performing digital investigations on Windows, Linux, and Mac memory images. (121)

113
Q

Where can you get Volatility?

A

It’s open source, from https://code.google.com/p/volatility/

114
Q

Where is the command reference for Volatility?

A

The Volatility wiki: https://code/google.com/p/volatility/wiki/CommandReference23 (for version 2.3)

115
Q

What is volatility written in ?

A

Python

116
Q

How do you execute Volatility?

A

vol.py -f [image] [plugin] –profile=[PROFILE]

117
Q

What are plugins for in volatility?

A

They tell the program what to do.

118
Q

What are profiles for in Volatility?

A

They specify which operating system version you’re analyzing.

119
Q

How can you pre set the memory image information in Volatility?

A

Use the VOLATILITY_LOCATION environment variable.

For example export VOLATILITY_LOCATION=file://(path)

120
Q

What Volatility plugin will determine what operating system a memory image came from?

A

imageinfo (p124)

121
Q

What flag in Volatility gives help?

A

-h

122
Q

Where do you find the Volatility options in the SANS books?

A

Book 2 p. 125.

123
Q

Where do you find the list of all volatility plugins in the SANS books?

A

Book 2, p. 126-9.

124
Q

What is Rekall?

A

A fork of Volatility that focuses on speed and performance.

125
Q

How do you execute Rekall?

A

rekall -f memory.img psscan (130)

126
Q

What is GRR?

A

Google Rapid Response (research this) p. 130.

127
Q

Which memory forensics tool requires an OS profile and which doesn’t?

A

Volatility does, Rekall doesn’t.

128
Q

Which memory forensics tool tends to lead in supporting OS versions out of Volatility and Rekall?

A

Rekall

129
Q

What is winpmem and osxpem?

A

p. 130

130
Q

Where can you get rekall?

A

https://code.google.com/p/rekall

131
Q

What does the imageinfo plugin do?

A

It’s a Volatility plugin that returns information like system date and time when the image was collected, KPCR, number of processors, operating system and service pack information.

132
Q

How can you speed up most Volatility plugins?

A

Give them the location of the KDBG using -g 0xADDRESS. Use imageinfo to get it.

133
Q

How do you find the KDBG address in Volatility?

A

imageinfo. Also the virtual address of the KdCopyDataBlock found via the kdbgscan plugin.

134
Q

What is imagecopy?

A

A volatility plugin that prepares non-standard memory images for analysis.

135
Q

What tool other than imagecopy can be used to convert hibernation images?

A

hibr2bin.exe (134)

136
Q

What are the parameters to Volatility’s imagecopy?

A

-f -O

137
Q

What Volatility plugins can be used to identify rogue processes?

A

pslist
psscan
pstree
pstotal

138
Q

Review Rogue Process plugins in Volatility

A

(138)

139
Q

What does Volatility’s pslist doe?

A

Print all running processes by following the EPROCESS linked list (even in LInux?)

140
Q

What are the important parameters of pslist?

A

-p (show information for specific process IDs)

141
Q

What does Volatility’s pslist provide for each process?

A 
Virtual offset of EPROCESS block
Process name
Process ID (PID)
Parent Process ID
Number of threads
Number of handles
Process start time
142
Q

What limitation does pslist have?

A

Rootkits can unlink malicious processes from the linked list rendering them invisible (really? how do they run?)

143
Q

How can you identify a terminated process?

A

It should have zero handles and zero threads.

144
Q

Note: Finding a system process with a terminated parent is suspicious.

A

.

145
Q

What is psscan?

A

A Volatility plugin that scans physical memory for EPROCESS pool allocations.

146
Q

What important parameters does psscan have?

A

None.

147
Q

How does psscan differ from pslist?

A

Psscan scans memory rather than following the EPROCESS list, so it can find unlinked/hidden processes, and processes that are no longer running.

148
Q

What information does psscan provide?

A 
Physical offset of EPROCESS block
Process name
Process ID
Parent Process ID
Page directory base offset (PDB)
Process start time
Process exit time
149
Q

What’s the difference between a physical memory offset and a virtual memory offset?

A

(143)

150
Q

What is -p for Volatility plugins?

A

Process ID

151
Q

What is -o usually used for in Volatility plugins?

A

Physical offset in memory

152
Q

What does a process appearing more than once in psscan results likely mean?

A

Just that it was moved around in physical memory.

153
Q

What is pstree?

A

A volatility plugin that displays the process list as a tree.

154
Q

What important parameters does pstree have?

A

-v for verbose information including image path and command line for each process.

155
Q

What limitation does pstree have?

A

It uses the EPROCESS linked list, so doesn’t show unlinked/hidden processes.

156
Q

What is pstree useful for?

A

Visually identifying malicious processes spawned by the wrong parent process.

157
Q

What information does pstree provide?

A 
Virtual offset of EPROCESS block
Process name
PID
PPID
Number of threads
number of handles
process start time
(146)
158
Q

What is pstotal?

A

A Volatility plugin that scans physical memory for EPROCESS pool allocations and identifies hidden processes only found in psscan output.

159
Q

What important parameters does pstotal have?

A
  • -output-file=OUTPUT FILE
  • -output=dot for vector capable output
  • c or –cmd to display command line including path
160
Q

What do the pstotal color outputs mean?

A

Red - Process is absent from pslist and has no exit time. Investigate.
Grey - Process is absent from pslist but has an exit timestamp. Probably just an exited process.
Light blue - Exit time is before the most recent boot. Probably leftover in memory image.
Dark blue - Exit time is after the most recent boot
Yellow - Indication of potential PID reuse.

161
Q

What should you check all processes for when trying to identify rogue processes?

A 
Correct image/executable name
Correct file location (path)
Correct parent process
Correct command line and parameters
Correct start time information
162
Q

What Volatility plugins can be used for analyzing process objects?

A 
dlllist
cmdline
getsids
handles
filescan
svcscan
cmdscan
consoles
163
Q

What is dlllist?

A

A Volatility plugin that displays loaded DLLs and the command line to start each process.

164
Q

What important parameters does dlllist have?

A

-p

165
Q

How can you get the base offset for a DLL?

A

Use the Volatility dlldump plugin.

166
Q

What is a PEB?

A

Process Environment Block (156)

167
Q

What does dlllist provide for each DLL?

A

Base offset
DLL size
DLL file path

168
Q

What plugin can provide more information about DLLs than dlllist?

A

ldrmodules (156, more)

169
Q

What is getsids?

A

A volatility plugin that displays Security IDentifiers for each process?

170
Q

What important parameters does dlllist have?

A

-p

171
Q

What is S-I-5-18?

A

The SID for LocalSystem (161)

172
Q

What is S-I-5-32-544?

A

The SID for Administrators

173
Q

What is S-I-1-0

A

The SID for Everyone

174
Q

What is S-I-5-11?

A

The SID for Authenticated Users

175
Q

What is S-I-16-16384

A

The SID for System Mandatory Level

176
Q

Read “How access tokens Work”

A

http://technet.microsoft.com/en-us/libraray/cc783557(v=ws.10).aspx

177
Q

What is S-I-5-32-546?

A

The SID for Guests

178
Q

What is S-I-5-32-545?

A

The SID for Users.

179
Q

SIDs are unique within…?

A

A Windows instance. Domain SIDs are unique throughout the enterprise.

180
Q

What are the three most popular SIDs?

A

LocalSystem, LocalService, NetworkService.

181
Q

What does the Volatility module handles do?

A

Prints a list of handles opened by a process

182
Q

What are the important parameters for the handles Volatility module?

A
  • p PID (can comma separate multiple)

- t type (there are about a dozen on p 165.)

183
Q

What other Volatility module besides handles can be used for more rigorous searching of file handles and mutants?

A

mutantscan

184
Q

What does the Volatility svcscan module do?

A

Scans memory image for Windows service records, giving information on associated processes and drivers

185
Q

What are the important parameters for the svcscan Volatility module?

A

-v (show service DLL)

186
Q

What is a common persistence mechanism for malware?

A

Windows Service

187
Q

What should be considered suspicious if found using Volatility’s svcscan module?

A

SERVICE_AUTO_START entries should be examined.

188
Q

What is one method for finding malicious drivers?

A

Drivers can be loaded via a service, so can be found using Volatility’s svcscan module.

189
Q

What method can identify processes stopped by malware?

A

Volatility’s svcscan module.

190
Q

What capability does Volatility have that Redline doesn’t?

A

Enumeration of services

191
Q

What is a Windows Service?

A

A special type of process that is intended to be run in the background without user input.

192
Q

Windows Services canload…

A

…both process executables and drivers.

193
Q

What is the only memory analysis tool that can identify services?

A

Volatility.

194
Q

What information does svcscan provide?

A 
Offset
Order
Start method (Disabled, System_Start, Boot_Start, Auto_Start, Demand_Start)
Process ID
Service Name
Display Name
Type (Process or driver)
State (Running or stopped)
Full path
195
Q

What does the -v option to svcscan do?

A

Identifies what DLL started a service by parsing the SYSTEM\CurrentControlSet\Services\Parameters\ServiceDLL registry key.

196
Q

Other than finding malicious services, what is important to do when reviewing the services that were running when a memory image was captured?

A

Also identify services which should be running, but which have been stopped.

197
Q

What services might malware stop?

A

Windows updates and antivirus. (170)

198
Q

What does SERVICE_AUTO_START indicate?

A

That a service will start on system boot.

199
Q

What is the wuaserv service?

A

(171)

200
Q

What are cmdscan and consoles?

A

Volatility modules that carve out full command histories and text console output from a memory image.

201
Q

What is csrss.exe?

A

173

202
Q

What is conhost.exe?

A

173

203
Q

How does cmdscan and consoles work?

A

By scanning the VAC tree of csrss.exe and conhost.exe, in particular the DOSKEY command history buffer kept by cmd.exe.

204
Q

How many entries does cmd.exe keep in its buffer by default?

A

50

205
Q

What structure does consoles look for?

A

CONSOLE_INFORMATION

206
Q

What is CONSOLE_INFORMATION?

A

A memory structurethat includes the console buffer, showing input and output those commands generated. It is parsed by the consoles Volatility plugin.

207
Q

What’s the difference between cmdscan and consoles?

A

Consoles only parses records from consoles active when memory was dumped. cmdscan can recover current and old remnants of command history buffers.

208
Q

What information does cmdscan provide?

A

Command process (where was history information found)
PID
CommandHistory (offset where history structure found)
(more on 174)

209
Q

What information does consoles provide?

A

175

210
Q

What process objects might provide a clue something is amiss?

A

DLLs, Handles, Services.

211
Q

What Volatility plugins provide network artifacts?

A 
connections
connscan
sockets
sockscan
netscan
212
Q

What is notable about the network artifact plugins in Volatility?

A

They’re the only ones that are operating system dependent. Radical changes were made starting in Vista. With Vista or later netscan must be used.

213
Q

What do connections and connscan do?

A

They are Volatility plugins that identify network connections.

214
Q

What does the Volatility connections plugin do?

A

It wanks the TCP connections singly linked list to find active network connections when the memory image was taken.

215
Q

What does the Volatility connscan module do?

A

It takes a brute force approach scanning anything in memory that resembles a _TCPT_OBJECT and tries to parse it.

216
Q

What is a drawback of connscan?

A

It attempts to parse objects which might no longer be in use, and which might have been partially overwritten. The results can be incorrect.

217
Q

What information does the connscan and connections plugin provide?

A

memory offset
local ip address
remote ip address
PID

218
Q

What network artifact can signal a malicious process?

A

A PID that shouldn’t be communicating on the network but that is. A legitimate PID that exhibits this behavior may have been compromised.

219
Q

What is the effect of hibernation on Windows connections?

A

They’re all closed prior to hibernation, so connscan is still effective, but connections wouldn’t return any results.

220
Q

What should the network profile of svchost.exe be?

A

It generally shouldn’t have any external connections.

221
Q

What do the sockets and sockscan modules do?

A

They’re Volatility plugins that enumerate network sockets.

222
Q

What does the sockets plugin do?

A

It walks the singly linked list and reports information on the socket objects.

223
Q

What does the sockscan module do?

A

It scans memory images looking for _ADDRESS_OBJECT objects and parses them.

224
Q

What information does sockets and sockscan provide?

A

182

225
Q

What is an important bit of information in the socket structure, and why?

A

Creation time.

A process with a passive listening socket on a suspicious port.

226
Q

What can you learn by comparing sockets and sockscan output?

A

Which sockets were alive and which were terminated or unlinked.

227
Q

What should you focus on when reviewing network artifacts?

A

Suspicious ports
Suspicious connections
Known bad IPs
Suspicious network behavior from processes
Interesting creation times of network sockets

228
Q

What happens if you use the wrong module for network artifact scanning in Volatility?

A

No errors are generated, so you can use the wrong one without realizing it.

229
Q

What automated analysis plugins exist for Volatility

A 
malsysproc
openioc_scan
baseline
processbl
servicebl
driverbl
230
Q

What does malsysproc do?

A

Automatically identifies suspicous processes

231
Q

What does openioc_scan?

A

Scans memory objects using OpenIOC signature files.

232
Q

What does baseline do?

A

Provides processbl servicebl, driverbl for baseline comparisons.

233
Q

What does processbl do?

A

Compare processes and loaded DLLs with a baseline image.

234
Q

What does servicebl do?

A

Comapres services with a baseline image.

235
Q

What does driverbl do?

A

Compares drivers with a baseline image.

236
Q

What is malsysproc designed to do?

A

Scan system processes for anomalies to find malware pretending to be legitimate system processes.

237
Q

Limitations of malsysproc?

A

Only scans common system processes (smss, csrss, winlogon, services, lsass, svchost, spoolsv, wininit), and common misspellings. (188)

238
Q

What does malprocfind do?

A

It’s a fork of malsysproc that adds useful checks like anomalous process SIDs and process hollowing.

239
Q

What does baseline do?

A

Compares memory objects found in a suspect image to those present in a known good image.

240
Q

What parameters does baseline take?

A
  • B (baseline image)
  • U (only show items not found in the baseline)
  • K (only show items present in the baseline) (190)
241
Q

190

A

190

242
Q

List Volatility code injection plugins

A

malfind, ldrmodules

243
Q

What does malfind do?

A

It’s a Volatility plugin that scans process memory sections looking for indications of code injection, then extracts those sections for further analysis.

244
Q

What parameters does malfind take?

A

195

245
Q

195

A

195

246
Q

MZ portable executable header?

A

196

247
Q

PAGE_EXECUTE_READWRITE?

A

Is this suspicous in itself? (202)

248
Q

What assembly identifies a function?

A

PUSH EBP

MOV EBP, ESP

249
Q

What does ldrmodules do?

A

(203)

250
Q

Volatility rootkit identification plugins

A

(210)

251
Q

DKOM

A

211

GCFA (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions