Hack the Memory Forensics
As I got deeper into digital forensics, I was tested with something that tests us all.. memory… but digitally! Part of Hack the Box’s Certified Defensive Security Analyst training was learning more about memory forensics.
Memory forensics, volatile memory analysis, is a specialized branch of digital forensics that focuses on examining and analyzing the volatile memory of a computer or digital device during the live state of the system at that particular time.
In previous modules regarding YARA and Sigma, I was introduced to Volatility Framework. A leading open-source memory forensics framework, its based on the Volatility Python script that includes a plethora of plugins, enabling it to dissect memory images with precision. The questions below tested my ability on Volatility’s usage.
Questions
Examine the file “/home/htb-student/MemoryDumps/Win7–2515534d.vmem” with Volatility. Enter the parent process name for @WanaDecryptor (Pid 1060) as your answer. Answer format: _.exe
To begin checking the running processes I ran the the following command.
vol.py -f /home/htb-student/MemoryDumps/Win7–2515534d.vmem — profile=Win7SP1x64 pslist
This revealed the a long list of running processes. Luckily I only needed to find PID 1060, which right next to it would reveal its parent process or PPID.
After a quick look I was able to find the name of PPID 1792. This confirmed to be the correct answer.
Examine the file “/home/htb-student/MemoryDumps/Win7–2515534d.vmem” with Volatility. tasksche.exe (Pid 1792) has multiple file handles open. Enter the name of the suspicious-looking file that ends with .WNCRYT as your answer. Answer format: _.WNCRYT
After doing some reading, rereading, and experimentation I was able to tweak the command from the first question to provide the output I needed to find the answer.
Get Luke’s stories in your inbox
Join Medium for free to get updates from this writer.
vol.py -f /home/htb-student/MemoryDumps/Win7–2515534d.vmem — profile=Win7SP1x64 handles -p 1792 — object-type=File
This output was able to show the correct WNCRYT file that was confirmed to be the correct answer.
Examine the file “/home/htb-student/MemoryDumps/Win7–2515534d.vmem” with Volatility. Enter the Pid of the process that loaded zlib1.dll as your answer.
Continuing the process of experimenting with commands to find the best fit. I was able to find the command that showed the output I needed, but then tweaked it so it would show the dll file I needed as well as the PID information I needed.
vol.py -f /home/htb-student/MemoryDumps/Win7–2515534d.vmem — profile=Win7SP1x64 dlllist | grep -B50 “zlib1.dll"
This revealed the PID number I needed, which confirmed to be correct.
Summary
This module took me further into Volatility usage. While it didn’t explore every plugin in depth, it reinforced the importance of syntax — getting the exact flags right can make or break your results.
If I could get through 9th-grade Spanish, I can also learn the “grammar” of 20+ computer tools and languages!
If you like this and want to be updated for more, please hit that subscribe button!
Keep Moving Forward,
Luke Raines
