Recollection
Description
Files
└─$ 7z x recollection.zip -p"hacktheblue"
└─$ la recollection.bin
Permissions Size User Group Date Modified Name
.rwxrwx--- 4.8G root vboxsf 6 Feb 10:03 recollection.bin Tasks
Task 1. What is the Operating System of the machine?
➜ .\vol2.exe -f .\recollection.bin imageinfo
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
AS Layer2 : FileAddressSpace (~\VBoxShare\recollection.bin)
PAE type : No PAE
DTB : 0x187000L
KDBG : 0xf80002a3f120L
Number of Processors : 1
Image Type (Service Pack) : 1
KPCR for CPU 0 : 0xfffff80002a41000L
KUSER_SHARED_DATA : 0xfffff78000000000L
Image date and time : 2022-12-19 16:07:30 UTC+0000
Image local date and time : 2022-12-19 22:07:30 +0600Task 2. When was the memory dump created?
Task 3. After the attacker gained access to the machine, the attacker copied an obfuscated PowerShell command to the clipboard. What was the command?
Task 4. The attacker copied the obfuscated command to use it as an alias for a PowerShell cmdlet. What is the cmdlet name?
Task 5. A CMD command was executed to attempt to exfiltrate a file. What is the full command line?
Task 6. Following the above command, now tell us if the file was exfiltrated successfully?
Task 7. The attacker tried to create a readme file. What was the full path of the file?
Task 8. What was the Host Name of the machine?
Task 9. How many user accounts were in the machine?
Task 10. In the "\Device\HarddiskVolume2\Users\user\AppData\Local\Microsoft\Edge" folder there were some sub-folders where there was a file named passwords.txt. What was the full file location/path?
Task 11. A malicious executable file was executed using command. The executable EXE file's name was the hash value of itself. What was the hash value?
Task 12. Following the previous question, what is the Imphash of the malicious file you found above?
Task 13: Following the previous question, tell us the date in UTC format when the malicious file was created?
Task 14: What was the local IP address of the machine?
Task 15: There were multiple PowerShell processes, where one process was a child process. Which process was its parent process?
Task 16: Attacker might have used an email address to login a social media. Can you tell us the email address?
Task 17: Using MS Edge browser, the victim searched about a SIEM solution. What is the SIEM solution's name?
Task 18: The victim user downloaded an exe file. The file's name was mimicking a legitimate binary from Microsoft with a typo (i.e. legitimate binary is powershell.exe and attacker named a malware as powershall.exe). Tell us the file name with the file extension?
Last updated