Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Forensics

This is a memory dump of compromised system, do some forensics kung-fu to explore the inside.

Task 1: Volatility forensics

This is a memory dump of the infected system. Download the file attached to this Task.

The MD5 hash of the uncompressed file is: ba44c4b977d28132faeb5fb8b06debce

Answer the questions below

  1. Download the victim.zip

  2. What is the Operating System of this Dump file? (OS name)

  3. What is the PID of SearchIndexer?

  4. What is the last directory accessed by the user?

    (The last folder name as it is?)

Task 2: Task2

Dig a little more...

Answer the questions below

  1. There are many suspicious open ports; which one is it? (ANSWER format: protocol:port)

  2. Vads tag and execute protection are strong indicators of malicious processes; can you find which they are? (ANSWER format: Pid1;Pid2;Pid3) 

Task 3: IOC SAGA

In the previous task, you identified malicious processes, so let's dig into them and find some Indicator of Compromise (IOC). You just need to find them and fill in the blanks (You may search for them on VirusTotal to discover more details).

Answer the questions below

  1. 'www.go****.ru' (write full url without any quotation marks)

  2. 'www.i****.com' (write full url without any quotation marks)

  3. 'www.ic******.com'

  4. 202.***.233.*** (Write full IP)

  5. ***.200.**.164 (Write full IP)

  6. 209.190.***.***

  7. What is the unique environmental variable of PID 2464?

Room Icon

Forensics

This is a memory dump of compromised system, do some forensics kung-fu to explore the inside.

hard

60 min

7,736

User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

This is a memory dump of the infected system. Download the file attached to this Task.

The hash of the uncompressed file is: ba44c4b977d28132faeb5fb8b06debce

Answer the questions below

Download the victim.zip

What is the Operating System of this Dump file? (OS name)

What is the PID of SearchIndexer?

What is the last directory accessed by the user?

(The last folder name as it is?)

Dig a little more...

Answer the questions below

There are many suspicious open ports; which one is it? (ANSWER format: protocol:port)

Vads tag and execute protection are strong indicators of malicious processes; can you find which they are? (ANSWER format: Pid1;Pid2;Pid3) 

In the previous task, you identified malicious processes, so let's dig into them and find some Indicator of Compromise (). You just need to find them and fill in the blanks (You may search for them on VirusTotal to discover more details).

Answer the questions below

'www.go****.ru' (write full url without any quotation marks)

'www.i****.com' (write full url without any quotation marks)

'www.ic******.com'

202.***.233.*** (Write full IP)

***.200.**.164 (Write full IP)

209.190.***.***

What is the unique environmental variable of PID 2464?