Scenario

A Windows Endpoint was recently compromised. Thanks to our cutting-edge EDR/IDS solution we immediately noticed it. The alert was escalated to Tier 2 (Incident Responders) for further investigation. As our Forensics guy, you were given the memory dump of the compromised host. You should continue to investigate.

https://app.letsdefend.io/challenge/memory-analysis

1- What was the date and time when Memory from the compromised endpoint was acquired?

2022-07-26 18:16:32

The SystemTime field inwindows.info plugin output shows the host’s system clock at the time the memory image was captured

2- What was the suspicious process running on the system?

lsass.exe

List processes: vol.py windows.pslist -f <memory.dmp> (or windows.pstree).

A second lsass.exe instance appears that is not the normal System LSASS. Normal lsass.exe should have wininit.exe (or services.exe depending on Windows) as its parent and only one instance.

The suspicious lsass.exe has an unexpected Parent PID of 3996 which maps to explorer.exe anomalous parent/child relationship for LSASS. Multiple instances + non-standard parent are strong indicators of process masquerading or process hollowing.

3- Analyze and find the malicious tool running on the system by the attacker

winpeas.exe