Forensicc studies volatility
1. List the processes that were running on the victim’s machine. Which process was most likely responsible for the initial exploit?

Figure 1 seeking the profile
As shown in figure one, when the command “vol imageinfo –f /root/Desktop/BF.vmem” is applied, the result shows the suggested profile which is WinXPSP2x86 and WinXPSP3x86.With that we can able to identify the profile victim is using.
Figure 2 Result of Pslist
By using the “Pslist” command, we are able to trace the process running in the victim and based on the scenario provided, the user was emailed a link to a suspicious PDF by a co-worker. The chaos happened after the PDF file is opened. As shown in figure 2, “AcroRd32.exe” with PID 1752 is most likely responsible for the exploit. The PPID (parent PID) of AcroRd32.exe is 888 which indicate firefox.exe.

2. List the sockets that were open on the victim’s machine during infection. Are there any suspicious processes that have sockets open?

Figure 3 Result of listing Sockets
Figure 3 shows the list of socket that were opened on the victim’s machine during the exploitation

Figure 4 Result of Connection
The figure above shows the list of connection found in victim’s machine and the most suspicious connection to external website is the AcroRd32.exe (PID 1752) and svchost.exe (PID 880). These application caught our attention because it does not have any outbound HTTP connections.

Figure 5 Information of IP
After finding it suspicious, we did a further investigation towards the Ip address and eventually we found 193.104.22.71 is an Iran hosting and 212.150.164.203 is an Israel hosting. Another thing we found interesting is when we refers to connection list above, we found the only process connected with the Iran hosting is PID 880 which is the svchost.exe while two processes connecting with Israel hosting are PID 888 firefox.exe and PID 1752 AcroRd.exe. Moreover, by referring to ftp://193.170.235.123/Lernbehelfe/Netzwerke/NWTU/Liste_Portnummern.pdf,
PID 880 svchost.exe has a socket object for TCP port 30301 where this port is normally associated with “BitTorrent” and so is unusual behaviour for this process. Moreover, PID 1752 (AcroRd32.exe) has a socket object on UDP port 1177 if we look on it clearly this is an Acrobat Reader process, so we concluded its unusual.

3. List any suspicious URLs that may be in the suspected process’s memory.

Figure 6 Command on Dump and View Process ID of 880
The figure above shows the command to obtain a dump of the memory from suspected process. By using the “grep” command we will able to search the relevant keyword in the dumped process and save it for review. From the lists of the url we can conclude the machine is being compromise. It is because we can identify the HTTP headers are mostly in kernel space. Thusby looking on some suspicious url such as http://193.104.22.71/~produkt/9j856f_4m9y8urb.php, we can identify it’s a virus referring to http://malwaretips.com. Other suspicious url would be the link which associated with old version.com, search-result-plus and etc. which been blacklisted in some antivirus company such as Norton and Mcafee.

Figure 7 List of Suspicious Url

Figure 8 List of Suspicious Url

Figure 9 List of Suspicious Url

Figure 10 List of Suspicious Url

Figure 11 List of Suspicious Url

Figure 12 List of Suspicious Url

Figure 13 List of Suspicious Url

Figure 14 List of Suspicious Url

Figure 15 List of Suspicious Url

Figure 16 List of Suspicious Url

Figure 17 List of Suspicious Url

Figure 18 List of Suspicious Url

Figure 19 List of Suspicious Url

Figure 20 List of Suspicious Url

Figure 21 List of Suspicious Url

Figure 22 List of Suspicious Url

Figure 23 List of Suspicious Url

Figure 24 List of Suspicious Url

Figure 25 List of Suspicious Urle

Figure 26 List of Suspicious Url

Figure 27 List of Suspicious Url

Figure 28 List of Suspicious Url

Figure 29 Command on Dump and View Process ID 1752

Figure 30 List of Suspicious Url

Figure 31 List of Suspicious Url

Figure 32 List of Suspicious Url

Figure 33 List of Suspicious Url

Figure 34 List of Suspicious Url

Figure 35 List of Suspicious Url

Figure 36 List of Suspicious Url

Figure 37 List of Suspicious Url

Figure 38 List of Suspicious Url

Figure 39 List of Suspicious Url

Figure 40 List of Suspicious Url

Figure 41 List of Suspicious Url
Figure 42 List of Suspicious Url

Figure 43 List of Suspicious Url

Figure 44 List of Suspicious Url

Figure 45 List of Suspicious Url

Figure 46 List of Suspicious Url

Figure 47 List of Suspicious Url

Figure 48 List of Suspicious Url

Figure 49 List of Suspicious Url

Figure 50 List of Suspicious Url

Figure 51 List of Suspicious Url
Figure 52 List of Suspicious Url

Figure 53 List of Suspicious Url

Figure 54 List of Suspicious Url

4. Are there any processes that contain URLs that may point to banking troubles? If so, what are these processes and what are the URLs?

Figure 55 View Memory Materials

Figure 56 Bank Url
The figure above shows the bank site which we believed the user might be involving into a banking fraud case. The link can be found in the memory of svchost.exe (PID 880), svchost.exe (PID 888) and AcroRd32.exe (PID 1752).

5. List suspicious files that were loaded by any processes on the victim’s machine. From this information, what was a possible payload of the initial exploit be that would be affecting the victim’s bank account?
To list all the suspicious files loaded by processes, we need to find all open files by processes on the system. To do this, we used the volatility “handles” plugin as shows. This command allow us to find registry keys, events, window station, desktops, threads and other type of objects. In this case, our focus will be on file.
AcroRD32.exe (PID 1752)

Figure 57 Suspicious file opened by Pid 1752
As shows in the in Figure 57, PDF.php file opened by Pid 1752 which pointed to AcroRD32.exe is most probably the files that was downloaded from search-network-plus.com/cache/PDF.php?st=Internet%20Explorer%206.0 in Firefox, and maybe related to initial download of malicious PDF file (as an email from co-workers)

Winlogon.exe (PID 644)

Figure 58 Suspicious file opened by Pid 644
As shows in Figure 58, we can saw that there are3 files being opened by PID 644 which pointed to Winlogon.exe. It seems like a malware files. The file is 118784 in size. Right after that we upload all these files to VirusTotal- a website which offer a service to analyze suspicious file for virus. The results showing that this is a Trojan which used sdra64.exe to create data files local.ds and user.ds. Whereby, local.ds is used to store the encrypted configuration and user.ds is used to store encrypted stolen data.

As we can see from the open files found in memory dump, the payload of the initial exploit was Zeus Trojan which caused the problem in victim’s bank account. This Trojan is famous in stealing bank account information which sends this information to the botmaster in real time. (Symantec, 2010)

6. Are there any related registry entries associated with the payload?
As refer to Symantec, Zeus Trojan added itself to the registry to start when Windows start, using the following subkeys: (Symantec, 2010)
i) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon ii) HKEY_CURRENT_USER\ SOFTWARE \Microsoft\Windows\CurrentVersion\Run
Therefore, we need to check the registry loaded in the memory using volatility to check whether any of this two registry exists.
Firstly, we used hivescan plugin in volatility to find the list of registry hives in the memory. The output is shown in Figure 59 below which is the offset of all registry hives.

Figure 57 hivelist results
Right after that, to find out the exact location of each registry hives, we used hivelist plugin in volatility. The results of hivelist are shown at Figure 58 below. As we can see, the exact location of the hives is shown.

Figure 58 hivelist result
However, our main focus here would be on HKLM\Software hives. Therefore, we used the offset (0xe1526748) as shown in Figure 59 below together with printkey plugins to view and determine the registry key and value.

Figure 59 Printkey Results
From the results shown in Figure 59, the registry key is spotted similar to those registry key added by Zeus Trojan as refer to Symantec. Hence, this confirmed our assumption. 7. What technique was used in the initial exploit to inject code in to the other processes?
In this question, we extract and executables file from AcroRead.exe process address space and analysed through VirusTotal. The result is shown in Figure 60 below. It is showing that the file downloaded from Adobe Acrobat process address space was infected by winlogon.exe. The registry is modified to be able to inject itself in every process address space. When the user access to the domain listed in Zues configuration file, the hacker begins to steal the credentials. However, this analysis is not completed yet as complete reverse engineering have to take place but it is not required in this case.

Figure 60 VirusTotal Results