Analyze a memory dump using Volatility to identify malicious processes, persistence mechanisms, defense evasion techniques, and map them to MITRE ATT&CK.
On May 2, 2024, a multinational corporation identified suspicious PowerShell processes on critical systems, indicating a potential malware infiltration. This activity poses a threat to sensitive data and operational integrity.You have been provided with a memory dump (
memory.dmp) from the affected system. Your task is to analyze the dump to trace the malware's actions, uncover its evasion techniques, and understand its persistence mechanisms.
Easy - Endpoint Forensics | Completion Achievement
Inside the provided VM, there are two relevant directories. The Tools directory contains a copy of the Volatility Framework 3, and the Artifacts directory contains the following:
ubuntu@ip-172-31-19-211:~/Desktop/Start here$ ls -lah Artifacts/
total 2.0G
drwxrwxr-x 2 ubuntu ubuntu 4.0K Apr 6 2025 .
drwxrwxr-x 4 ubuntu ubuntu 4.0K Apr 6 2025 ..
-rw-rw-r-- 1 ubuntu ubuntu 2.0G May 2 2024 memory.dmp
-rw-rw-r-- 1 ubuntu ubuntu 9.8K Apr 6 2025 windows.psscan_out.txt- Identifying the parent process reveals the source and potential additional malicious activity. What is the name of the suspicious process that spawned two malicious PowerShell processes?
Let's start by using vol.py to see a hierarchical list of running processes with windows.pstree to find any powershell.exe instances:
It seems both of these powershell.exe instances have a parent process ID of 4596. However, when looking at the pslist output, we can't find a process corresponding to that ID.
ubuntu@ip-172-31-19-211:~/Desktop/Start here$ Tools/volatility3-develop/vol.py -f Artifacts/memory.dmp windows.pslist | grep 4596
6980ress4596 powershell.exe 0xb882f10e9080 13 - 1 True 2024-05-02 06:57:59.000000 N/A Disabled
7656 4596 powershell.exe 0xb882f0db8080 13 - 1 True 2024-05-02 06:57:59.000000 N/A Disabled
6796 4596 RegSvcs.exe 0xb882f1031080 5 - 1 True 2024-05-02 06:58:00.000000 N/A DisabledLet's try using windows.psscan (takes a while to finish):
ubuntu@ip-172-31-19-211:~/Desktop/Start here$ Tools/volatility3-develop/vol.py -f Artifacts/memory.dmp windows.psscan
Volatility 3 Framework 2.7.0
Progress: 100.00 PDB scanning finished
PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output
...
4596 3800 InvoiceCheckLi 0xb882f107e080 0 - 1 False 2024-05-02 06:57:42.000000 2024-05-02 06:58:00.000000 DisabledThe process name isn't fully visible... Let's try using windows.cmdline and grep to find information from that substring:
ubuntu@ip-172-31-19-211:~/Desktop/Start here$ Tools/volatility3-develop/vol.py -f Artifacts/memory.dmp windows.cmdline | grep Invoice
6980resspowershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Lee\AppData\Local\Temp\InvoiceCheckList.exe"- By determining which executable is utilized by the malware to ensure its persistence, we can strategize for the eradication phase. Which executable is responsible for the malware's persistence?
One method of persistence is to create a scheduled task on Windows. By looking back at the psscan output and looking for other processes ran under parent PID 4596, we can find another interesting process possibly related to malware persistence:
3512 4596 schtasks.exe 0xb882f10e3080 0 - 1 False 2024-05-02 06:57:59.000000 2024-05-02 06:57:59.000000 Disabled- Understanding child processes reveals potential malicious behavior in incidents. Aside from the PowerShell processes, what other active suspicious process, originating from the same parent process, is identified?
In a previous command, we found all process related to the process ID 4596. There was another process besides the PowerShell processes:
ubuntu@ip-172-31-19-211:~/Desktop/Start here$ Tools/volatility3-develop/vol.py -f Artifacts/memory.dmp windows.pslist | grep 4596
...
6796 4596 RegSvcs.exe 0xb882f1031080 5 - 1 True 2024-05-02 06:58:00.000000 N/A Disabled- Analyzing malicious process parameters uncovers intentions like defense evasion for hidden, stealthy malware. What PowerShell cmdlet used by the malware for defense evasion?
Going back to the processes related to PID 4596, we can find an interesting cmdlet mentioned in the execution of the PowerShell processes:
Add-MpPreference? Let's research what this does based on official Windows docs:
This cmdlet is definitely useful for defense evasion.
- Recognizing detection-evasive executables is crucial for monitoring their harmful and malicious system activities. Which two applications were excluded by the malware from the previously altered application's settings?
We can find our answer by looking at pstree processes running powershell.exe and the argument passed after -ExclusionPath:
-ExclusionPath "C:\Users\Lee\AppData\Local\Temp\InvoiceCheckList.exe"
-ExclusionPath "C:\Users\Lee\AppData\Roaming\HcdmIYYf.exe"- What is the specific MITRE sub-technique ID associated with PowerShell commands that aim to disable or modify antivirus settings to evade detection during incident analysis?
Let's look that up online. I found a short description by Picus Security, and the actions shown in the memdump appear to follow this description quite accurately based on how the attacker deactivated Windows Defender for other malicious files.
- Determining the user account offers valuable information about its privileges, whether it is domain-based or local, and its potential involvement in malicious activities. Which user account is linked to the malicious processes?
Looking at the SIDs will help in finding an associated user account to the malicious process. Let's use the PID of one of the powershell.exe processes to guarantee that the process will be visible by windows.getsids:
ubuntu@ip-172-31-19-211:~/Desktop/Start here$ Tools/volatility3-develop/vol.py -f Artifacts/memory.dmp windows.getsids | grep 6980
6980 powershell.exe S-1-5-21-1649652813-3480061347-1948202237-1001 Lee
6980 powershell.exe S-1-5-21-1649652813-3480061347-1948202237-513 Domain Users
6980 powershell.exe S-1-1-0 Everyone
6980 powershell.exe S-1-5-114 Local Account (Member of Administrators)
...Lee is an user account, probably associated with the malware being executed. Another way of verifying the related user account would've been to focus on the filepaths and reading the string after \Users\:
"C:\Users\Lee\AppData\Local\Temp\InvoiceCheckList.exe"