Volatility Traces (CyberDefenders)

SOC Analyst Track: Tier 1 | Level: 2 | Category: Endpoint Forensics | Difficulty: Easy

Scenario: On May 2, 2024, a multinational corporation identified suspicious PowerShell processes on critical systems, indicating a potential malware infiltration. This activity poses a threat to sensitive data and operational integrity.

You have been provided with a memory dump (memory.dmp) from the affected system. Your task is to analyze the dump to trace the malware's actions, uncover its evasion techniques, and understand its persistence mechanisms.

Note: Block comments that begin with “#” are added for context and are not considered to be entered via Command-Line Interface (CLI).

Q1

Identifying the parent process reveals the source and potential additional malicious activity. What is the name of the suspicious process that spawned two malicious PowerShell processes?

Answer: InvoiceCheckList.exe

Method 1:

# For the first question, it is noted that two PowerShell processes were spawned by a suspicious process. 

# The first approach is to identify the PowerShell processes from the memory dump file by utilizing the windows.pslist plugin 
  to list all processes.

vol -f memory.dmp windows.pslist | grep powershell

Figure 1

# As shown in Figure 1, two PowerShell processes revealed similar Parent Process IDs (PPIDs) as 4596 
  that will enable correlation between parent-child relationship.

# The windows.psscan plugin scans for all processes within the memory dump file. 
  Therefore, narrowing further with the provided PPID reveals the suspicious Parent Process.

vol -f memory.dmp windows.psscan | grep 4596

Figure 2

# Based upon Figure 2, it appears that the output of the suspicious process returns only 14 characters.

# To identify the full length of the process name, the windows.pstree plugin to provide the name of the suspicious process.

vol -f memory.dmp windows.pstree | grep 4596

Figure 3

Method 2:

# Another method to identify the full name of the suspicious process is the windows.cmdline plugin.

vol -f memory.dmp windows.cmdline | grep InvoiceCheckLi

Figure 4

Q2

By determining which executable is utilized by the malware to ensure its persistence, we can strategize for the eradication phase. Which executable is responsible for the malware’s persistence?

Answer: schtasks.exe

Method:

# After uncovering the suspicious process that spawned the two PowerShell processes, 
  the windows.psscan plugin revealed additional spawned processes such as but not limited to schtasks.exe.

# schtasks.exe is a native Windows Utility for scheduling specific tasks via command-line 
  which is capable of being leveraged by threat actors to abuse for persistence.

vol -f memory.dmp windows.psscan | grep 4596

Figure 5

Q3

Understanding child processes reveals potential malicious behavior in incidents. Aside from the PowerShell processes, what other active suspicious process, originating from the same parent process, is identified?

Answer: RegSvcs.exe

Method:

# Similar approach from Q2, the windows.psscan plugin reveals additional processes.

# After identifying the processes that were spawned such as PowerShell and schtasks, 
  the RegSvcs is revealed to be amongst the list of spawned processes.

# RegSvcs.exe is a legitmate Windows binary utilized for installing/registering .NET Component Object Model (COM) assemblies. 
  Some common factors of abuse by threat actors is to hide malware within a known process.

vol -f memory.dmp windows.psscan | grep 4596

Figure 6

Q4

Analyzing malicious process parameters uncovers intentions like defense evasion for hidden, stealthy malware. What PowerShell cmdlet used by the malware for defense evasion?

Answer: Add-MpPreference

Method 1:

# The methods shown to solve Q1 revealed PowerShell commands involving the suspicious process for InvoiceCheckList.exe.

# After revisiting the list of processes that displays the parent-child relationship(s), the PowerShell cmdlet and parameter "Add-MpPreference -ExclusionPath" 
  modifies the Windows Defender module to exclude the specified path(s) from being flagged during real-time or scheduled scans.

vol -f memory.dmp windows.pstree | grep 4596

Figure 7

Method 2:

# An alternative approach to reveal the PowerShell parameters is by leveraging the windows.cmdline plugin 
  then narrowing down specifically on the identified parent process.

vol -f memory.dmp windows.cmdline | grep InvoiceCheckLi

Figure 8

Q5

Recognizing detection-evasive executables is crucial for monitoring their harmful and malicious system activities. Which two applications were excluded by the malware from the previously altered application’s settings?

Answer: InvoiceCheckList.exe,HcdmIYYf.exe

Method 1:

# As shown in Figures 3 and 7, two applications, InvoiceCheckList.exe and HcdmIYYf.exe, are observed 
  to be excluded to evade detection from Windows Defender.

vol -f memory.dmp windows.pstree | grep 4596

Figure 9

Method 2:

# An alernative approach to achieve similar results is the windows.cmdline plugin. 

vol -f memory.dmp windows.cmdline | egrep Add-MpPreference\|ExclusionPath

Figure 10

Q6

What is the specific MITRE sub-technique ID associated with PowerShell commands that aim to disable or modify antivirus settings to evade detection during incident analysis?

Answer: T1562.001

Method: Review MITRE ATT&CK Framework

Q7

Determining the user account offers valuable information about its privileges, whether it is domain-based or local, and its potential involvement in malicious activities. Which user account is linked to the malicious processes?

Answer: Lee

Method 1:

# After discovering the malicious process that spawned multiple child processes as well as identifying the evasion techniques,
  the observed files that are excluded from Windows Defender contains the directory path with the compromised user account "Lee".

vol -f memory.dmp windows.pstree | grep 4596

Figure 11

Method 2:

# An alternative to achieve similar results is by leveraging the windows.cmdline plugin 
  and narrowing down specifically on the PowerShell parameters.

vol -f memory.dmp windows.cmdline | egrep Add-MpPreference\|ExclusionPath

Figure 12

References

[embed]CyberDefenders - Blue Team Training Platform CyberDefenders is a blue team training platform for SOC analysts, threat hunters, DFIR, and security blue teams to…cyberdefenders.org

[embed]volatility3.plugins package - Volatility 3 2.27.0 documentation NOTE: This file is important for core plugins to run (which certain components such as the windows registry layers) are…volatility3.readthedocs.io

[embed]Add-MpPreference (Defender) The Add-MpPreference cmdlet modifies settings for Windows Defender.learn.microsoft.com

[embed]Impair Defenses: Disable or Modify Tools Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities…attack.mitre.org