CyberDefenders: DumpMe blueteam challenge.

DumpMe

SHA1SUM	70f1bafca632f7518cb0a0ee126246b040247b37
Published	May 30, 2021
Author	Champlain College
Size	1.2 GB
Tags	Volatility Autopsy DFIR Memory Forensics

Instructions	Unzip the challenge (pass: cyberdefenders.org)

Your progress

0% Completed0/16 Questions

Your score

0/1475

Memory Image Forensics

Last solve

1 day ago by Vishnuks

Scenario:

One of the SOC analysts took a memory dump from a machine infected with a meterpreter malware. As a Digital Forensicators, your job is to analyze the dump, extract the available indicators of compromise (IOCs) and answer the provided questions.

Tools:

Volatility 2

#	Question	Weight	Solved
#1	What is the SHA1 hash of triage.mem (memory dump)?	25	636
Hint Report an issue

#2	What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)	25	624
Hint Report an issue

#3	What was the process ID of notepad.exe?	50	626
Hint Report an issue

#4	Name the child process of wscript.exe.	50	625
Hint Report an issue

#5	What was the IP address of the machine at the time the RAM dump was created?	75	616
Hint Report an issue

#6	Based on the answer regarding the infected PID, can you determine the IP of the attacker?	75	607
Hint Report an issue

#7	How many processes are associated with VCRUNTIME140.dll?	75	572
Hint Report an issue

#8	After dumping the infected process, what is its md5 hash?	100	528
Hint Report an issue

#9	What is the LM hash of Bob's account?	75	526
Hint Report an issue

#10	What memory protection constants does the VAD node at 0xfffffa800577ba10 have?	75	494
Hint Report an issue

#11	What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?	75	490
Hint Report an issue

#12	There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)	125	492
Hint Report an issue

#13	An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)	100	468
Hint Report an issue

#14	What was written in notepad.exe at the time when the memory dump was captured?	200	444
Hint Report an issue

#15	What is the short name of the file at file record 59045?	150	450
Hint Report an issue

#16	This box was exploited and is running meterpreter. What was the infected PID?	200	485
Hint Report an issue