Honeynet Forensics Challenge 3 – Banking Troubles

The challenge

Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an email from a fellow co-worker that pointed to a PDF file. Upon opening, the employee did not seem to notice anything, however recently they have had unusual activity in their bank account. Company X was able to obtain a memory image of the employee’s virtual machine upon suspected infection. Company X wishes you to analyze the virtual memory and report on any suspected activities found. Questions can be found below to help in the formal report for the investigation.

  1. List the processes that were running on the victim’s machine. Which process was most likely responsible for the initial exploit? (2pts)
  2. List the sockets that were open on the victim’s machine during infection. Are there any suspicious processes that have sockets open? (4pts)
  3. List any suspicious URLs that may be in the suspected process’s memory. (2pts)
  4. Are there any other processes that contain URLs that may point to banking troubles? If so, what are these processes and what are the URLs? (4pts)
  5. Were there any files that were able to be extracted from the initial process? How were these files extracted? (6pts)
  6. If there was a file extracted from the initial process, what techniques did it use to perform the exploit? (8pts)
  7. List suspicious files that were loaded by any processes on the victim’s machine. From this information, what was a possible payload of the initial exploit be that would be affecting the victim’s bank account? (2pts)
  8. If any suspicious files can be extracted from an injected process, do any anti-virus products pick up the suspicious executable? What is the general result from anti-virus products? (6pts)
  9. Are there any related registry entries associated with the payload? (4pts)
  10. What technique was used in the initial exploit to inject code in to the other processes? (6pts)

Continue reading “Honeynet Forensics Challenge 3 – Banking Troubles”

Honeynet Forensics Challenge 2 – Browsers under attack

. The challenge

A network trace with attack data is provided. (Note that the IP address of the victim has been changed to hide the true location.) Analyze and answer the following questions:

  1. List the protocols found in the capture. What protocol do you think the attack is/are based on? (2pts)
  2. List IPs, hosts names / domain names. What can you tell about it – extrapolate? What to deduce from the setup? Does it look like real situations? (4pts)
  3. List all the web pages. List those visited containing suspect and possibly malicious javascript and who’s is connecting to it? Briefly describe the nature of the malicious web pages (6pts)
  4. Can you sketch an overview of the general actions performed by the attacker? (2pts)
  5. What steps are taken to slow the analysis down? (2pts)
  6. Provide the javascripts from the pages identified in the previous question. Decode/deobfuscate them too. (8pts)
  7. On the malicious URLs at what do you think the variable ‘s’ refers to? List the differences. (2pts)
  8. Which operating system was targeted by the attacks? Which software? And which vulnerabilities? Could the attacks been prevented? (4pts)
  9. What actions does the shellcodes perform? Please list the shellcodes (+md5 of the binaries). What’s the difference between them? (8pts)
  10. Was there malware involved? What is the purpose of the malware(s)? (We are not looking for a detailed malware analysis for this challenge) (4pts)

Continue reading “Honeynet Forensics Challenge 2 – Browsers under attack”