CyberDefenders: BlueTeam CTF Challenges

DumpMe

SHA1SUM	70f1bafca632f7518cb0a0ee126246b040247b37
Published	May 30, 2021
Author	Champlain College
Size	1.2 GB
Tags	Volatility DFIR Windows Memory

Instructions	Unzip the challenge (pass: cyberdefenders.org)

Your progress

0% Completed0/16 Questions

Your score

0/1475

Digital Forensics

Last solve

today by HIIMA

Scenario:

One of the SOC analysts took a memory dump from a machine infected with a meterpreter malware. As a Digital Forensicators, your job is to analyze the dump, extract the available indicators of compromise (IOCs) and answer the provided questions.

Tools:

#	Question	Weight	Solved
#1	What is the SHA1 hash of Triage-Memory.mem (memory dump)?	25	1060
Hint Report an issue

#2	What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)	25	1045
Hint Report an issue

#3	What was the process ID of notepad.exe?	50	1048
Hint Report an issue

#4	Name the child process of wscript.exe.	50	1038
Hint Report an issue

#5	What was the IP address of the machine at the time the RAM dump was created?	75	1015
Hint Report an issue

#6	Based on the answer regarding the infected PID, can you determine the IP of the attacker?	75	997
Hint Report an issue

#7	How many processes are associated with VCRUNTIME140.dll?	75	943
Hint Report an issue

#8	After dumping the infected process, what is its md5 hash?	100	862
Hint Report an issue

#9	What is the LM hash of Bob's account?	75	867
Hint Report an issue

#10	What memory protection constants does the VAD node at 0xfffffa800577ba10 have?	75	797
Hint Report an issue

#11	What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?	75	790
Hint Report an issue

#12	There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)	125	797
Hint Report an issue

#13	An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)	100	767
Hint Report an issue

#14	What was written in notepad.exe at the time when the memory dump was captured?	200	722
Hint Report an issue

#15	What is the short name of the file at file record 59045?	150	724
Hint Report an issue

#16	This box was exploited and is running meterpreter. What was the infected PID?	200	783
Hint Report an issue

Submit Writeup