Windows Memory Forensic Analysis

Windows Memory Forensic Analysis involves examining a memory dump from a Windows system to uncover evidence of malicious activity, running processes, network connections, and more. Memory analysis is particularly useful for investigating advanced threats, fileless malware, and volatile evidence that is not stored on disk.

Setting Up Volatility3 in the Ubuntu Environment

sudo apt-get update
sudo apt install python3-pip
pip3 install volatility3

pip3 install capstone
source .profile
vol -h

Important Files for Memory Analysis

hiberfil.sys: The hiberfil.sys file is a system file used by Windows to store the contents of RAM (Random Access Memory) when a system enters hibernation mode. From a digital forensics perspective, it can be a rich source of volatile data that would otherwise be lost when the system is powered off.

Pagefile.sys: The Pagefile is a physical extension of Random Access Memory (RAM). In Windows, when the RAM reached compacity the system will move idle data to pagefile.sys (located on the hard disk) to free up space. The pagefile.sys can be located at %SYSTEMDRIVE%\pagefile.sys and may contain information related to user activity.

Swapfile.sys: The Swapfile is similar to the Pagefile as both use hard drive space as temporary storage when RAM is full. Starting with Windows 10, the Swapfile specifically handles inactive Microsoft Store apps, storing them in swapfile.sys to preserve their state for later use. Located alongside pagefile.sys at %SYSTEMDRIVE%\swapfile.sys, it may also contain data related to user activity. Together, the Swapfile and Pagefile help ensure sufficient free RAM for smooth system performance.

Gathering Windows System Information with Volatility3

Plugin: windows.info

Use: Identifies the operating system version and architecture

vol -f win10-memory.raw windows.info

Detecting Suspicious Windows Processes

Plugin: windows.pstree

Use: Used to display processes in a hierarchical tree format based on their parent-child relationships.

vol -f win10-memory.raw windows.pstree

Here are the three services to note:

• notepad.exe: 4668

• powershell.exe: 5712

• AtomicService.exe: 5064

Dumping Processes From the Memory

Let's see some details about the process with PID 5064.

vol -f win10-memory.raw windows.pslist --pid 5064

Let's identify the parent process of this process.

vol -f win10-memory.raw windows.pslist --pid 668

vol -f win10-memory.raw windows.pslist --pid 5064 --dump 

strings 5064.AtomicService..0xb60000.dmp

We can obtain the file's hash and search for it on VirusTotal.

Detecting and Analyzing Injected DLLs

Let's retrieve the DLLs for the notepad.exe process.

vol -f win10-memory.raw windows.dlllist --pid 4668 

Let's dump the DLLs loaded by this process.

vol -f win10-memory.raw windows.dlllist --pid 4668 --dump

strings dlls/pid.4668.T1055.001.dll.0x27aaaca06d0.0x7ffb2be40000.dmp | more

Identifying Process Owners and Associated SIDs

Identifying process owners and associated Security Identifiers (SIDs) is a crucial step in forensic investigations to determine which user account is running a specific process.

SID (Security Identifier): A unique identifier used by Windows to represent a user or group. It helps track process ownership and permissions.

vol -f win10-memory.raw windows.getsids --pid 4668 5712 5064

Registry Keys

vol -f win10-memory.raw windows.registry.hivelist

We have a registry key named AtomicRedTeam.

vol -f win10-memory.raw windows.registry.printkey --offset 0xe78203872000 --key AtomicRedTeam

• --offset 0xe78203872000:

  • Specifies the memory offset where the registry hive resides. This is typically obtained from prior analysis using a plugin like windows.registry.hivelist.

• --key AtomicRedTeam:

  • Indicates the specific registry key to inspect.

The command queries the registry hive loaded at a specific memory offset to locate and display the contents of the registry key named AtomicRedTeam.