1.
Windows Memory Forensic Analysis -- Aashish Kunte Club Hack 2010

2.
Security Incident <ul><li>A secured company’s network gets a port 5548 traffic on the Null (SinkHole) Router ! </li></ul><ul><li>The activity seems to be a suspicious Service Scan ! </li></ul><ul><li>Source Computer is a Windows Web Server …. </li></ul>

3.
Security Incident Response <ul><li>Set of procedures to examine a computer security incident . </li></ul><ul><li>The process involves figuring out what was happened </li></ul><ul><li>Helps mitigate security risk through proactive measures and world-class defensive tactics </li></ul>

4.
Digital Forensics <ul><li>In depth Analysis & Complex Techniques </li></ul><ul><li>The goal of computer forensics is to explain the current state of a digital artifact </li></ul><ul><li>The scope of a forensic analysis can vary from simple information retrieval to reconstructing a series of events. </li></ul>

5.
Technique <ul><li>Preparation </li></ul><ul><li>Acquisition </li></ul><ul><li>Enumeration </li></ul><ul><li>Analysis </li></ul><ul><li>Recovery </li></ul><ul><li>Presentation </li></ul>

6.
Windows Memory <ul><li>live activities from the contents of RAM on a Windows Machine. </li></ul><ul><li>During a post-mortem analysis: specifically encrypted, compressed or hidden processes. </li></ul><ul><li>RAM constituted &quot;electronically stored information&quot; under rule 34(a) of the Federal Rules of Civil Procedure. </li></ul>

7.
What Information ??? <ul><li>Processes </li></ul>Open Files & Registry Handles Network Information Passwords & Cryptographic Keys Unencrypted Content Hidden Data Malicious Code DLL’s

8.
Analysis Sit Back … … Relax !!

9.
<ul><li>How Volatile Memory Works ? </li></ul>

10.
<ul><li>Acquisition of Windows Memory </li></ul><ul><li>Volatile Memory Organized ? </li></ul>

11.
<ul><li>Processes </li></ul><ul><li>What is Process Memory ? </li></ul><ul><li>Process Enumeration </li></ul>

12.
<ul><li>How to find Suspicious Files </li></ul><ul><li>and Suspicious Keys ? </li></ul><ul><li>Open Files </li></ul><ul><li>Windows Registry </li></ul><ul><li>Loaded DLL’s </li></ul>Video : HBGary Responder Pro & Digital DNA -identifying malware

13.
<ul><li>Network Information </li></ul><ul><li>Why from Volatile Memory ? </li></ul><ul><li>Open Sockets </li></ul><ul><li>Open Ports </li></ul><ul><li>Open TCP Connections </li></ul>

14.
<ul><li>What the heck is VAD Tree ? </li></ul>

15.
<ul><li>Passwords and Encryption Keys </li></ul><ul><li>SSDT </li></ul>Video : To find out Passwords and Encryption Keys from Windows Memory Video : To Analyze SSDT using : Python and Volatility Framework

16.
<ul><li>Anti-Forensic Attack (DKOM) </li></ul>

17.
<ul><li>Static & Dynamic Analysis </li></ul><ul><li>Reverse Engineering </li></ul><ul><li>Files of Unknown Origin </li></ul>

18.
Quick Bites <ul><li>Suspicious Log Entries </li></ul><ul><li>Suspicious Processes and Services </li></ul><ul><li>Suspicious Files and Registry Keys </li></ul><ul><li>Suspicious Network Usage </li></ul><ul><li>Suspicious Scheduled Tasks </li></ul><ul><li>Suspicious Accounts </li></ul>

19.
Tools <ul><li>Basic Tools </li></ul><ul><li>Memdump, KnTTools </li></ul><ul><li>FATKit </li></ul><ul><li>WMFT </li></ul><ul><li>Procenum </li></ul><ul><li>Idetect </li></ul><ul><li>The Volatility Framework </li></ul><ul><li>VAD Tools </li></ul><ul><li>Commercial Tools </li></ul><ul><li>Memoryze </li></ul>

20.
Future

21.
Questions ??? Club Hack 2010