Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

Day-O

A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.

Task 1: Memory Forensics Day-O

STRANGE & UNUSUAL ACTIVITY // FORENSICS 

Day-O

MEDIUM
A document review session took an unexpected turn. Examine a Windows memory capture to reconstruct what ran, trace the suspicious activity, and recover what was left behind.
MEMORY FORENSICS MALWARE ANALYSIS
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

Sophia Reyes opened a document review package. The preview froze, and an unexpected executable region appeared in the application’s memory.

With the workstation’s memory preserved, follow the evidence, uncover the hidden payload, and determine what it was prepared to do.

EVIDENCE PROVIDED
+ Memory Dump
02 // OBJECTIVES
01. Identify the suspicious process and its associated activity.
02. Examine the memory artifacts for evidence of malicious execution.
03. Investigate the malware and determine how it operates.
04. Recover the information needed to understand the compromise.
ANALYST NOTE
A process name tells only part of the story. Compare what was running with what its memory contains, and use the recovered artifacts to support your conclusions.
ANALYST WORKSPACE
+ Evidence: ~/Desktop/artifacts/
+ Tools: ~/Desktop/artifacts/tools/
+ Volatility 3 (vol), Ghidra and Speakeasy are installed for offline analysis.
+ Use the provided analysis-python environment for the bundled Python modules.
 
SUSPICIOUS_MEMORY_ACTIVITY // CASE FILE OPEN
DAY_O // FORENSICS // MALWARE_ANALYSIS

Answer the questions below

  1. Which executable contains the suspicious payload?

  2. What is the starting virtual address of its private executable memory region?

  3. Which file associated with the process also contains the same payload?

  4. Which MITRE ATT&CK sub-technique best describes how the payload is stored in the recovered PNG file?

  5. Which Windows API does the payload call to launch its next stage?

  6. What encryption key does the decoded stage use to decrypt the document cache?

  7. What is the flag?

Room Icon

Day-O

A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.

medium

45 min

Team room

92

User profile photo.
User profile photo.

To access material, start machines and answer questions login.

Score updated
Score updated

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Lab Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.
Attacker machine
Status:Off
Lab machine
Status:Off
STRANGE & UNUSUAL ACTIVITY // FORENSICS 

Day-O

MEDIUM
A document review session took an unexpected turn. Examine a Windows memory capture to reconstruct what ran, trace the suspicious activity, and recover what was left behind.
MEMORY FORENSICS MALWARE ANALYSIS
 
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION

Sophia Reyes opened a document review package. The preview froze, and an unexpected executable region appeared in the application’s memory.

With the workstation’s memory preserved, follow the evidence, uncover the hidden payload, and determine what it was prepared to do.

EVIDENCE PROVIDED
+ Memory Dump
02 // OBJECTIVES
01. Identify the suspicious process and its associated activity.
02. Examine the memory artifacts for evidence of malicious execution.
03. Investigate the malware and determine how it operates.
04. Recover the information needed to understand the compromise.
ANALYST NOTE
A process name tells only part of the story. Compare what was running with what its memory contains, and use the recovered artifacts to support your conclusions.
ANALYST WORKSPACE
+ Evidence: ~/Desktop/artifacts/
+ Tools: ~/Desktop/artifacts/tools/
+ Volatility 3 (vol), and Speakeasy are installed for offline analysis.
+ Use the provided analysis-python environment for the bundled Python modules.
 
SUSPICIOUS_MEMORY_ACTIVITY // CASE FILE OPEN
DAY_O // FORENSICS // MALWARE_ANALYSIS
Answer the questions below

Which executable contains the suspicious payload?

What is the starting virtual address of its private executable memory region?

Which file associated with the process also contains the same payload?

Which MITRE ATT&CK sub-technique best describes how the payload is stored in the recovered PNG file?

Which Windows API does the payload call to launch its next stage?

What encryption key does the decoded stage use to decrypt the document cache?

What is the flag?