NintendoHunt
(Write-up)
This is more like a guide to obtain the answers. I believe this way is more appropriate in the learning journey.
Overview
You have been hired as a digital forensics investigator to investigate a potential security breach at a company. The company has recently noticed unusual network activity and suspects that there may be a malicious process running on one of their computers. Your task is identifying the malicious process and gathering information about its activity.
Supportive Tools
Choosing an Appropriate Profile for Volatility
I spent a long time researching what profile might be possible for Volatility because it won’t work unless there is a profile. I tried imageinfo plugin but that took forever. So, after a bit of googling, I found that kdgbscan plugin can produce the same results (some say it is more accurate). It produced seven Windows profiles, I tried them all, and found Win10x64_17134 is the most stable.
Questions
1 - What is the process ID of the currently running malicious process?
PID 8560 svchost.exe because usually svchost.exe is parented by services.exe. However, this process was not. It was parented by explorer.exe which is unusual.
2 - What is the md5 hash hidden in the malicious process memory?
I dumped 8560 process. Then I used `strings -n 32 8560.dmp` command to print to a minimum of 32 chars (MD5), then I skimmed through and noticed
t.h.e. fl.ag.is. M2ExOTY5N2YyOTA5NWJjMjg5YTk2ZTQ1MDQ2Nzk2ODA="
I decoded this base64 string and obtained the md5 hash, which is 3a19697f29095bc289a96e4504679680
3 - What is the process name of the malicious process parent?
This is from the result of question#1, where the parent process is explorer.exe.
4 - What is the MAC address of this machine's default gateway?
Usually, network information in Windows memory dumps can be obtained from the SYSTEM hive in the registry. However, this dump does not have the SYSTEM hive, but the SOFTWARE hive. I googled how to obtain the default gateway’s MAC address.
It is in the Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged key.
And, voila, I have it.
5 - What is the name of the file that is hidden in the alternative data stream?
This can be solved using mftparser plugin. I output the mftparser in a separate text file, then I used egrep command to search for text files with three chars.
6 - What is the full path of the browser cache created when the user visited "www.13cubed.com" ?
Same methodology from the previous question. I grepped for 13cubed.