Scenario

The Account Executive called the SOC earlier and sounds very frustrated and angry. He stated he can’t access any files on his computer and keeps receiving a pop-up stating that his files have been encrypted. You disconnected the computer from the network and extracted the memory dump of his machine and started analyzing it with Volatility. Continue your investigation to uncover how the ransomware works and how to stop it!

https://blueteamlabs.online/home/challenge/memory-analysis-ransomware-7da6c9244d

1- Run “vol.py -f infected.vmem --profile=Win7SP1x86 psscan” that will list all processes. What is the name of the suspicious process?

@WanaDecryptor

first we identify the OS using imageinfo plugin

then we use pslist and from the result we have @WanaDecryptor and or4qtckT.exe which is both suspicious

but i go with @WanaDecryptor it likely associated with WannaCry ransomware

2- What is the parent process ID for the suspicious process?

2732

you can see the answer from pslist but for better view we use pstree

3- What is the initial malicious executable that created this process?