Reference no: EM133680904

Homework: Investigation

Purpose

In this homework, you will examine a volatile memory dump to investigate a potential malware case. Your analysis will primarily be done with Volatility Workbench, but you may also use other utilities to look at the disk from other perspectives. In Autopsy, the evidence can be imported as an Unallocated Space image to run intake scripts. Be sure to make a note of all applications and methods you use in your examination.

Instructions

You'll need to use the following resources to complete the homework:

I. Investigation 04 Sample Evidence*

II. Volatility Workbench*

III. (Optional) Download and use the report template (See the Investigation and Forensics Challenge module for the templates)

IV. (Optional) Strings

V. (Optional) Autopsy the open-source forensic suite* (or another suite, such as EnCase or FTK.)

Accessed via the Virtual Lab.

After reading the Investigation 4 Scenario, open your forensic tool and import the sample evidence into the case. Begin a forensic report to document your examination.

Scenario

This scenario takes place circa 2010.

Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an email from a fellow co-worker that pointed to a PDF file. Upon opening, the employee did not seem to notice anything. However, recently they have had unusual activity in their bank account.

Company X was able to obtain a memory image of the employee's virtual machine upon suspected infection. Company X wishes you to analyze the virtual memory and report on any suspected activities found.

Task

I. What specific indicators in the memory image indicate possible malicious activity?

II. Is there any evidence of malware execution or persistence mechanisms in the memory image?

III. Is there any evidence of privilege escalation or unauthorized access to the memory image?

IV. Is there any evidence of memory-resident malware or rootkits that could avoid traditional detection methods?

V. Was there any sensitive information, such as credentials or financial data, has been accessed or altered within the memory image?

VI. Are there any unusual processes or applications running in the virtual machine's memory during the suspected infection?

VII. Does the sender have any other unusual activities?

VIII. What were the processes that were running on the employees computer?