← back to portfolio
Memory Forensics
Windows Memory Forensics: Ransomware Delivery
Executive Summary
A Windows memory dump was analyzed to trace a ransomware infection to its source. The infected user
downloaded a fake software crack that retrieved a ransomware payload from a remote URL, which then
executed from the Temp directory and modified a system registry key. Volatility artifacts including
file scans, dumped executables, and string analysis were used to reconstruct the full delivery chain
and recover credentials relevant to the investigation.
Scenario
Investigate a Windows memory dump to identify the infected user, determine how ransomware was delivered,
locate the ransomware executable, and identify system modifications performed by the malware.
Evidence Collected
| Artifact | Source | Why It Mattered |
| windows.sessions | Volatility | Identified users present on the system |
| windows.filescan | Volatility | Revealed suspicious files and ransomware location |
| windows.dumpfiles | Volatility | Allowed extraction of suspicious executables |
| Strings Analysis | Dumped files | Revealed URLs and registry modifications |
| VirusTotal Behavior | Malware hash | Revealed registry modification activity |
Timeline
| User | Event | Source |
| flapjack | Downloaded Windows10Crack.exe | filescan |
| flapjack | Ransomware payload retrieved from remote URL | dumped file |
| flapjack | XGUbdem0hd.exe present in Temp directory | filescan |
Key Findings
- Four users were present on the system; the infected user was flapjack.
- The ransomware was dropped by a fake crack tool, Windows10Crack.exe.
- The ransomware payload was retrieved from http://48.147.154.231/XGUbdem0hd.exe.
- The ransomware executable was located at virtual offset 0xe4870d737570.
- The ransomware modified HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters.
- A credential associated with "AdminRecovery" was recovered: K3ller!$Supp1y.
Attack Chain
Execution
Windows10Crack.exe executed by the user.
Payload Retrieval
XGUbdem0hd.exe downloaded from a remote URL.
Execution
Ransomware executed from the Temp directory.
System Modification
Registry key modified under LanmanWorkstation\Parameters.
Analyst Notes
Started by identifying users present on the system using windows.sessions.
Pivoted to files within the Downloads directory to identify suspicious executables.
Located Windows10Crack.exe and dumped the file for analysis.
Used strings analysis and malware inspection to identify the ransomware download URL.
Searched for additional files associated with the infected user and identified XGUbdem0hd.exe within the Temp directory.
Used strings analysis and VirusTotal behavior information to identify the registry key modified by the ransomware.
Lessons Learned
- windows.sessions can quickly identify users active on a system.
- windows.filescan is useful for locating suspicious files within memory.
- Dumped files can be analyzed with strings to identify URLs and malware behavior.
- Registry modifications can sometimes be identified through malware behavior reports or embedded command strings.