← back to portfolio
Memory Forensics

Windows Memory Forensics: Ransomware Delivery

Category
Memory Forensics
Status
Complete
Infected User
flapjack
Method
Volatility memory analysis
MITRE ATT&CK
T1204.002 User Execution T1105 Ingress Tool Transfer T1486 Data Encrypted for Impact T1112 Modify Registry T1552 Unsecured Credentials
Executive Summary A Windows memory dump was analyzed to trace a ransomware infection to its source. The infected user downloaded a fake software crack that retrieved a ransomware payload from a remote URL, which then executed from the Temp directory and modified a system registry key. Volatility artifacts including file scans, dumped executables, and string analysis were used to reconstruct the full delivery chain and recover credentials relevant to the investigation.
Table of Contents
  1. Scenario
  2. Evidence Collected
  3. Timeline
  4. Key Findings
  5. Attack Chain
  6. Analyst Notes
  7. Lessons Learned

Scenario

Investigate a Windows memory dump to identify the infected user, determine how ransomware was delivered, locate the ransomware executable, and identify system modifications performed by the malware.

Evidence Collected

ArtifactSourceWhy It Mattered
windows.sessionsVolatilityIdentified users present on the system
windows.filescanVolatilityRevealed suspicious files and ransomware location
windows.dumpfilesVolatilityAllowed extraction of suspicious executables
Strings AnalysisDumped filesRevealed URLs and registry modifications
VirusTotal BehaviorMalware hashRevealed registry modification activity

Timeline

UserEventSource
flapjackDownloaded Windows10Crack.exefilescan
flapjackRansomware payload retrieved from remote URLdumped file
flapjackXGUbdem0hd.exe present in Temp directoryfilescan

Key Findings

Attack Chain

Execution
Windows10Crack.exe executed by the user.
Payload Retrieval
XGUbdem0hd.exe downloaded from a remote URL.
Execution
Ransomware executed from the Temp directory.
System Modification
Registry key modified under LanmanWorkstation\Parameters.

Analyst Notes

Started by identifying users present on the system using windows.sessions.
Pivoted to files within the Downloads directory to identify suspicious executables.
Located Windows10Crack.exe and dumped the file for analysis.
Used strings analysis and malware inspection to identify the ransomware download URL.
Searched for additional files associated with the infected user and identified XGUbdem0hd.exe within the Temp directory.
Used strings analysis and VirusTotal behavior information to identify the registry key modified by the ransomware.

Lessons Learned