CyberDefenders: BlueTeam CTF Challenges

DumpMe

SHA1SUM	70f1bafca632f7518cb0a0ee126246b040247b37
Published	May 30, 2021
Author	Champlain College
Size	1.2 GB
Tags	Volatility DFIR Windows Memory

Instructions	Unzip the challenge (pass: cyberdefenders.org)

Your progress

0% Completed0/16 Questions

Your score

0/1475

Digital Forensics

Last solve

today by p1stachios

Scenario:

One of the SOC analysts took a memory dump from a machine infected with a meterpreter malware. As a Digital Forensicators, your job is to analyze the dump, extract the available indicators of compromise (IOCs) and answer the provided questions.

Tools:

#	Question	Weight	Solved
#1	What is the SHA1 hash of Triage-Memory.mem (memory dump)?	25	896
Hint Report an issue

#2	What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)	25	888
Hint Report an issue

#3	What was the process ID of notepad.exe?	50	892
Hint Report an issue

#4	Name the child process of wscript.exe.	50	887
Hint Report an issue

#5	What was the IP address of the machine at the time the RAM dump was created?	75	870
Hint Report an issue

#6	Based on the answer regarding the infected PID, can you determine the IP of the attacker?	75	857
Hint Report an issue

#7	How many processes are associated with VCRUNTIME140.dll?	75	809
Hint Report an issue

#8	After dumping the infected process, what is its md5 hash?	100	745
Hint Report an issue

#9	What is the LM hash of Bob's account?	75	749
Hint Report an issue

#10	What memory protection constants does the VAD node at 0xfffffa800577ba10 have?	75	685
Hint Report an issue

#11	What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?	75	681
Hint Report an issue

#12	There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)	125	687
Hint Report an issue

#13	An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)	100	659
Hint Report an issue

#14	What was written in notepad.exe at the time when the memory dump was captured?	200	623
Hint Report an issue

#15	What is the short name of the file at file record 59045?	150	619
Hint Report an issue

#16	This box was exploited and is running meterpreter. What was the infected PID?	200	668
Hint Report an issue

Submit Writeup