【CyberDefenders】DumpMe【Writeup】

# 初めに
どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___CyberDefenders___ （以下リンク参考）の「___DumpMe___」にチャレンジした際のWriteupになります

https://cyberdefenders.org/blueteam-ctf-challenges/65

※本チャレンジについてはRed側のペネトレというよりはBlue側の分析力を問われるものになります。

# What is the SHA1 hash of Triage-Memory.mem (memory dump)?
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/5412fe54-e6cf-1398-4fe1-f9bd0db4fdf0.png)

___Ans: C95E8CC8C946F95A109EA8E47A6800DE10A27ABD___

# What volatility profile is the most appropriate for this machine? (ex: Win10x86_14393)
`imageinfo`を見ます。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem imageinfo
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418
                     AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (/home/remnux/Downloads/Triage-Memory.mem)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf800029f80a0L
          Number of Processors : 2
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff800029f9d00L
                KPCR for CPU 1 : 0xfffff880009ee000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2019-03-22 05:46:00 UTC+0000
     Image local date and time : 2019-03-22 01:46:00 -0400
```
回答文字数制限で２択くらいで絞れます。

___Ans: Win7SP1x64___

# What was the process ID of notepad.exe?
![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/dfdddcc9-bafe-11b5-202d-508fce39de0f.png)

___Ans: 3032___

# Name the child process of wscript.exe.
`pstree`で確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 pstree
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Name                                                  Pid   PPid   Thds   Hnds Time
-------------------------------------------------- ------ ------ ------ ------ ----
 0xfffffa8003de39c0:explorer.exe                     1432   1308     28    976 2019-03-22 05:32:07 UTC+0000
. 0xfffffa80042aa430:cmd.exe                         1408   1432      1     23 2019-03-22 05:34:12 UTC+0000
. 0xfffffa8005d067d0:StikyNot.exe                    1628   1432      8    183 2019-03-22 05:34:42 UTC+0000
. 0xfffffa80042dbb30:chrome.exe                      3248   1432     32    841 2019-03-22 05:35:14 UTC+0000
.. 0xfffffa8005442b30:chrome.exe                     4232   3248     14    233 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa80047beb30:chrome.exe                     3244   3248      7     91 2019-03-22 05:35:15 UTC+0000
.. 0xfffffa80053306f0:chrome.exe                     1816   3248     14    328 2019-03-22 05:35:16 UTC+0000
.. 0xfffffa8005300b30:chrome.exe                     4156   3248     14    216 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa8005419b30:chrome.exe                     4240   3248     14    215 2019-03-22 05:35:17 UTC+0000
.. 0xfffffa800540db30:chrome.exe                     4520   3248     10    234 2019-03-22 05:35:18 UTC+0000
.. 0xfffffa80052f0060:chrome.exe                     2100   3248      2     59 2019-03-22 05:35:15 UTC+0000
.. 0xfffffa80053cbb30:chrome.exe                     4688   3248     13    168 2019-03-22 05:35:19 UTC+0000
. 0xfffffa800474c060:OUTLOOK.EXE                     3688   1432     30   2023 2019-03-22 05:34:37 UTC+0000
. 0xfffffa8004798320:calc.exe                        3548   1432      3     77 2019-03-22 05:34:43 UTC+0000
. 0xfffffa80053d3060:POWERPNT.EXE                    4048   1432     23    765 2019-03-22 05:35:09 UTC+0000
. 0xfffffa8004905620:hfs.exe                         3952   1432      6    214 2019-03-22 05:34:51 UTC+0000
.. 0xfffffa8005a80060:wscript.exe                    5116   3952      8    312 2019-03-22 05:35:32 UTC+0000
... 0xfffffa8005a1d9e0:UWkpjFjDzM.exe                3496   5116      5    109 2019-03-22 05:35:33 UTC+0000
.... 0xfffffa8005bb0060:cmd.exe                      4660   3496      1     33 2019-03-22 05:35:36 UTC+0000
. 0xfffffa80054f9060:notepad.exe                     3032   1432      1     60 2019-03-22 05:32:22 UTC+0000
. 0xfffffa8005b49890:vmtoolsd.exe                    1828   1432      6    144 2019-03-22 05:32:10 UTC+0000
. 0xfffffa800474fb30:taskmgr.exe                     3792   1432      6    134 2019-03-22 05:34:38 UTC+0000
. 0xfffffa80053f83e0:EXCEL.EXE                       1272   1432     21    789 2019-03-22 05:33:49 UTC+0000
. 0xfffffa8004083880:FTK Imager.exe                  3192   1432      6    353 2019-03-22 05:35:12 UTC+0000
 0xfffffa8003c72b30:System                              4      0     87    547 2019-03-22 05:31:55 UTC+0000
. 0xfffffa8004616040:smss.exe                         252      4      2     30 2019-03-22 05:31:55 UTC+0000
 0xfffffa80050546b0:csrss.exe                         332    324     10    516 2019-03-22 05:31:58 UTC+0000
 0xfffffa8005259060:wininit.exe                       380    324      3     78 2019-03-22 05:31:58 UTC+0000
. 0xfffffa8005680910:services.exe                     476    380     12    224 2019-03-22 05:31:59 UTC+0000
.. 0xfffffa8005409060:dllhost.exe                    2072    476     13    194 2019-03-22 05:32:14 UTC+0000
.. 0xfffffa80055b0060:wmpnetwk.exe                   2628    476      9    210 2019-03-22 05:32:18 UTC+0000
.. 0xfffffa800583db30:svchost.exe                    1028    476     19    307 2019-03-22 05:32:05 UTC+0000
.. 0xfffffa8005775b30:svchost.exe                     796    476     15    368 2019-03-22 05:32:03 UTC+0000
... 0xfffffa80059e6890:dwm.exe                       1344    796      3     88 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005508650:SearchIndexer.                 2456    476     13    766 2019-03-22 05:32:17 UTC+0000
.. 0xfffffa80057beb30:svchost.exe                     932    476     10    568 2019-03-22 05:32:03 UTC+0000
.. 0xfffffa800432f060:svchost.exe                    3300    476     13    346 2019-03-22 05:34:15 UTC+0000
.. 0xfffffa8005478060:msdtc.exe                      2188    476     12    146 2019-03-22 05:32:15 UTC+0000
.. 0xfffffa800577db30:svchost.exe                     820    476     33   1073 2019-03-22 05:32:03 UTC+0000
... 0xfffffa80059cc620:taskeng.exe                   1292    820      4     83 2019-03-22 05:32:07 UTC+0000
... 0xfffffa8004300620:taskeng.exe                   1156    820      4     93 2019-03-22 05:34:14 UTC+0000
.. 0xfffffa80059cb7c0:taskhost.exe                   1276    476      8    183 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005b4eb30:vmtoolsd.exe                   1852    476     10    314 2019-03-22 05:32:11 UTC+0000
.. 0xfffffa800570d060:svchost.exe                     672    476      7    341 2019-03-22 05:32:02 UTC+0000
.. 0xfffffa8005a324e0:FileZilla Serv                 1476    476      9     81 2019-03-22 05:32:07 UTC+0000
.. 0xfffffa8005c4ab30:svchost.exe                    2888    476     11    152 2019-03-22 05:32:20 UTC+0000
.. 0xfffffa8005ba0620:ManagementAgen                 1932    476     10    102 2019-03-22 05:32:11 UTC+0000
.. 0xfffffa80056e1060:svchost.exe                     592    476      9    375 2019-03-22 05:32:01 UTC+0000
... 0xfffffa80054d2380:WmiPrvSE.exe                  2196    592     11    222 2019-03-22 05:32:15 UTC+0000
... 0xfffffa8005c8e440:WmiPrvSE.exe                  2436    592      9    245 2019-03-22 05:32:33 UTC+0000
... 0xfffffa80047cb060:iexplore.exe                  3576    592     12    403 2019-03-22 05:34:48 UTC+0000
.... 0xfffffa80047e9540:iexplore.exe                 2780   3576      6    233 2019-03-22 05:34:48 UTC+0000
.. 0xfffffa8005850a30:spoolsv.exe                     864    476     12    279 2019-03-22 05:32:04 UTC+0000
.. 0xfffffa80057e4560:svchost.exe                     232    476     15    410 2019-03-22 05:32:03 UTC+0000
.. 0xfffffa80058ed390:OfficeClickToR                 1136    476     23    631 2019-03-22 05:32:05 UTC+0000
.. 0xfffffa8005af24e0:VGAuthService.                 1768    476      3     89 2019-03-22 05:32:09 UTC+0000
.. 0xfffffa8004330b30:sppsvc.exe                     3260    476      4    149 2019-03-22 05:34:15 UTC+0000
.. 0xfffffa800575e5b0:svchost.exe                     764    476     20    447 2019-03-22 05:32:02 UTC+0000
. 0xfffffa80056885e0:lsass.exe                        484    380      7    650 2019-03-22 05:32:00 UTC+0000
. 0xfffffa8005696b30:lsm.exe                          492    380     10    155 2019-03-22 05:32:00 UTC+0000
 0xfffffa8005268b30:winlogon.exe                      416    364      3    110 2019-03-22 05:31:58 UTC+0000
 0xfffffa800525a9e0:csrss.exe                         372    364     11    557 2019-03-22 05:31:58 UTC+0000
. 0xfffffa80042ab620:conhost.exe                     1008    372      2     55 2019-03-22 05:34:12 UTC+0000
. 0xfffffa8005c1ab30:conhost.exe                     4656    372      2     49 2019-03-22 05:35:36 UTC+0000
 0xfffffa8005be12c0:FileZilla Serv                   1996   1860      3     99 2019-03-22 05:32:12 UTC+0000
```
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/00228669-2e1b-4d67-b2d7-b9cf26f3108b.png)

___Ans: UWkpjFjDzM.exe___

# What was the IP address of the machine at the time the RAM dump was created?
`netscan`を確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 netscan
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Offset(P)          Proto    Local Address                  Foreign Address      State            Pid      Owner          Created
0x13e057300        UDPv4    10.0.0.101:55736               *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05b4f0        UDPv6    ::1:55735                      *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05b790        UDPv6    fe80::7475:ef30:be18:7807:55734 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05d4b0        UDPv6    fe80::7475:ef30:be18:7807:1900 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05dec0        UDPv4    127.0.0.1:55737                *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05e3f0        UDPv4    10.0.0.101:1900                *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e05eab0        UDPv6    ::1:1900                       *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e064d70        UDPv4    127.0.0.1:1900                 *:*                                   2888     svchost.exe    2019-03-22 05:32:20 UTC+0000
0x13e02bcf0        TCPv4    -:49220                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e035790        TCPv4    -:49223                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e036470        TCPv4    -:49224                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e258010        UDPv4    127.0.0.1:55560                *:*                                   5116     wscript.exe    2019-03-22 05:35:32 UTC+0000
0x13e305a50        UDPv4    0.0.0.0:5355                   *:*                                   232      svchost.exe    2019-03-22 05:32:09 UTC+0000
0x13e360be0        UDPv4    0.0.0.0:63790                  *:*                                   504                     2019-03-22 05:45:47 UTC+0000
0x13e490ec0        UDPv4    0.0.0.0:5355                   *:*                                   232      svchost.exe    2019-03-22 05:32:09 UTC+0000
0x13e490ec0        UDPv6    :::5355                        *:*                                   232      svchost.exe    2019-03-22 05:32:09 UTC+0000
0x13e5683e0        UDPv4    10.0.0.101:137                 *:*                                   4        System         2019-03-22 05:32:06 UTC+0000
0x13e594250        UDPv4    10.0.0.101:138                 *:*                                   4        System         2019-03-22 05:32:06 UTC+0000
0x13e597ec0        UDPv4    0.0.0.0:0                      *:*                                   232      svchost.exe    2019-03-22 05:32:06 UTC+0000
0x13e597ec0        UDPv6    :::0                           *:*                                   232      svchost.exe    2019-03-22 05:32:06 UTC+0000
0x13e61fb30        UDPv6    fe80::7475:ef30:be18:7807:546  *:*                                   764      svchost.exe    2019-03-22 05:46:23 UTC+0000
0x13e918010        UDPv4    0.0.0.0:56372                  *:*                                   1816     chrome.exe     2019-03-22 05:45:51 UTC+0000
0x13e9cd730        UDPv4    127.0.0.1:57374                *:*                                   1136     OfficeClickToR 2019-03-22 05:32:18 UTC+0000
0x13ea8e6a0        UDPv4    127.0.0.1:61704                *:*                                   3688     OUTLOOK.EXE    2019-03-22 05:34:44 UTC+0000
0x13ead0bf0        UDPv4    127.0.0.1:55614                *:*                                   4048     POWERPNT.EXE   2019-03-22 05:35:15 UTC+0000
0x13ebc6c20        UDPv4    0.0.0.0:5353                   *:*                                   3248     chrome.exe     2019-03-22 05:35:17 UTC+0000
0x13ebea890        UDPv4    0.0.0.0:5353                   *:*                                   3248     chrome.exe     2019-03-22 05:35:17 UTC+0000
0x13ebea890        UDPv6    :::5353                        *:*                                   3248     chrome.exe     2019-03-22 05:35:17 UTC+0000
0x13e2c6b10        TCPv4    0.0.0.0:21                     0.0.0.0:0            LISTENING        1476     FileZilla Serv 
0x13e2c6b10        TCPv6    :::21                          :::0                 LISTENING        1476     FileZilla Serv 
0x13e2c7850        TCPv6    ::1:14147                      :::0                 LISTENING        1476     FileZilla Serv 
0x13e2c96b0        TCPv4    127.0.0.1:14147                0.0.0.0:0            LISTENING        1476     FileZilla Serv 
0x13e2c9be0        TCPv4    0.0.0.0:21                     0.0.0.0:0            LISTENING        1476     FileZilla Serv 
0x13e3a1150        TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        484      lsass.exe      
0x13e3a1150        TCPv6    :::49155                       :::0                 LISTENING        484      lsass.exe      
0x13e3b2010        TCPv4    0.0.0.0:49155                  0.0.0.0:0            LISTENING        484      lsass.exe      
0x13e430580        TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        820      svchost.exe    
0x13e430580        TCPv6    :::49154                       :::0                 LISTENING        820      svchost.exe    
0x13e431820        TCPv4    0.0.0.0:49154                  0.0.0.0:0            LISTENING        820      svchost.exe    
0x13e57e010        TCPv4    10.0.0.101:139                 0.0.0.0:0            LISTENING        4        System         
0x13e71cef0        TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        672      svchost.exe    
0x13e720660        TCPv4    0.0.0.0:135                    0.0.0.0:0            LISTENING        672      svchost.exe    
0x13e720660        TCPv6    :::135                         :::0                 LISTENING        672      svchost.exe    
0x13e72f010        TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        380      wininit.exe    
0x13e72f6e0        TCPv4    0.0.0.0:49152                  0.0.0.0:0            LISTENING        380      wininit.exe    
0x13e72f6e0        TCPv6    :::49152                       :::0                 LISTENING        380      wininit.exe    
0x13e770240        TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        764      svchost.exe    
0x13e772980        TCPv4    0.0.0.0:49153                  0.0.0.0:0            LISTENING        764      svchost.exe    
0x13e772980        TCPv6    :::49153                       :::0                 LISTENING        764      svchost.exe    
0x13ebb3010        TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        476      services.exe   
0x13ebb3010        TCPv6    :::49156                       :::0                 LISTENING        476      services.exe   
0x13ebcdef0        TCPv4    0.0.0.0:80                     0.0.0.0:0            LISTENING        3952     hfs.exe        
0x13e2348a0        TCPv4    -:49366                        192.168.206.181:389  CLOSED           504                     
0x13e397190        TCPv4    10.0.0.101:49217               10.0.0.106:4444      ESTABLISHED      3496     UWkpjFjDzM.exe 
0x13e3986d0        TCPv4    -:49378                        213.209.1.129:25     CLOSED           504                     
0x13e3abae0        TCPv4    -:49226                        72.51.60.132:443     CLOSED           4048     POWERPNT.EXE   
0x13e3e7010        TCPv6    -:0                            38db:7705:80fa:ffff:38db:7705:80fa:ffff:0 CLOSED           1136     OfficeClickToR 
0x13e441830        TCPv6    -:0                            382b:c703:80fa:ffff:382b:c703:80fa:ffff:0 CLOSED           1        ?RK????       
0x13e4e4910        TCPv4    10.0.0.101:49208               52.109.12.6:443      CLOSED           504                     
0x13e55fae0        TCPv4    10.0.0.101:49209               52.96.44.162:443     CLOSED           504                     
0x13e71b540        TCPv4    -:0                            104.208.112.5:0      CLOSED           1        ?RK????       
0x13e73b560        TCPv4    -:49266                        35.190.69.156:443    CLOSED           504                     
0x13e7c6010        TCPv4    10.0.0.101:49204               172.217.6.195:443    CLOSED           1816     chrome.exe     
0x13ead7cf0        TCPv4    10.0.0.101:49202               172.217.10.68:443    CLOSED           1816     chrome.exe     
0x13f5898a0        TCPv4    0.0.0.0:49156                  0.0.0.0:0            LISTENING        476      services.exe   
0x13f5899c0        TCPv4    0.0.0.0:445                    0.0.0.0:0            LISTENING        4        System         
0x13f5899c0        TCPv6    :::445                         :::0                 LISTENING        4        System         
0x13f4facf0        TCPv4    10.0.0.101:49262               52.109.12.6:443      ESTABLISHED      3688     OUTLOOK.EXE    
0x13f50a010        TCPv4    -:49265                        213.186.33.3:443     CLOSED           504                     
0x13f5289f0        TCPv4    -:49234                        72.51.60.133:80      CLOSED           3688     OUTLOOK.EXE    
0x13f7b4ec0        UDPv4    0.0.0.0:55707                  *:*                                   232      svchost.exe    2019-03-22 05:45:44 UTC+0000
0x13f7e8670        UDPv4    127.0.0.1:59411                *:*                                   3576     iexplore.exe   2019-03-22 05:34:49 UTC+0000
0x13fc6f1b0        UDPv4    0.0.0.0:55102                  *:*                                   232      svchost.exe    2019-03-22 05:45:36 UTC+0000
0x13fc78dc0        UDPv4    127.0.0.1:53361                *:*                                   1272     EXCEL.EXE      2019-03-22 05:34:03 UTC+0000
0x13f7ae010        TCPv4    10.0.0.101:49263               52.96.44.162:443     ESTABLISHED      3688     OUTLOOK.EXE    
0x13fa93cf0        TCPv4    -:49173                        72.51.60.132:443     CLOSED           1272     EXCEL.EXE      
0x13fa95cf0        TCPv4    -:49170                        72.51.60.132:443     CLOSED           1272     EXCEL.EXE      
0x13fa969f0        TCPv4    -:0                            56.219.119.5:0       CLOSED           1272     EXCEL.EXE      
0x13fbd07e0        TCPv4    -:49372                        212.227.15.9:25      CLOSED           504                     
0x13fc857e0        TCPv4    -:49167                        72.51.60.132:443     CLOSED           1272     EXCEL.EXE      
remnux@remnux:~/Downloads$ 
```
パット見わかると思います。

___Ans: 10.0.0.101___

# Based on the answer regarding the infected PID, can you determine the IP of the attacker?
`malfind`で悪意のあるProcessを見つけます。（おそらくさっきの`UWkpjFjDzM.exe`なんでしょうが）
![6-1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c98f02fa-899b-5053-4708-34d2e8f374cd.png)
![6-2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/30373f7a-4ecd-3151-1906-8542f88ba839.png)
予想通りですね。此奴のProcessが3496なのでそれで先ほどの`netscan`に`grep`かけます。
![6-3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/0d6d4532-1534-64d5-b81e-36da7330f281.png)

___Ans: 10.0.0.106___

# How many processes are associated with VCRUNTIME140.dll?
`dlllist`を確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 dlllist | grep VCRUNTIME140.dll
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
0x000007fefa5c0000            0x16000             0xffff 2019-03-22 05:32:05 UTC+0000   C:\Program Files\Common Files\Microsoft Shared\ClickToRun\VCRUNTIME140.dll
0x00000000745f0000            0x15000             0xffff 2019-03-22 05:33:49 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000            0x15000             0xffff 2019-03-22 05:34:37 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000            0x15000                0x3 2019-03-22 05:34:49 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
0x00000000745f0000            0x15000             0xffff 2019-03-22 05:35:09 UTC+0000   C:\Program Files (x86)\Microsoft Office\root\Office16\VCRUNTIME140.dll
```

___Ans: 5___

# After dumping the infected process, what is its md5 hash?
`memdump`でダンプを取ります。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 memdump -p 3496 -D out
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
************************************************************************
Writing UWkpjFjDzM.exe [  3496] to 3496.dmp
remnux@remnux:~/Downloads$ 
```
ハッシュを確認します。
```bash
remnux@remnux:~/Downloads/out$ md5sum 3496.dmp 
6654c0ab83bb8fa9cb64c9078c9c8468  3496.dmp
```
あれ？違う？あ、メモリじゃなくてProcessだったわ。`memdump`で直接何やられたか見ること多いのでProcessをvolで取ることあまりなかったので...
さっきの`memdump`を`procdump`に変更して取ります。その後にハッシュ確認。
![8.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/abc589b5-7f45-a5f3-eb7b-7c68a51009f2.png)

___Ans: 690ea20bc3bdfb328e23005d9a80c290___

# What is the LM hash of Bob's account?
`hashdump`を確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 hashdump
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Bob:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
```

___Ans: aad3b435b51404eeaad3b435b51404ee___

# What memory protection constants does the VAD node at 0xfffffa800577ba10 have?
`vadinfo`を見ます。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 vadinfo | grep -10 0xfffffa800577ba10
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Flags: Protection: 4
Protection: PAGE_READWRITE
Vad Type: VadNone
ControlArea @fffffa8005740740 Segment fffff8a001021f30
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:                2 NumberOfUserReferences:          3
Control Flags: Commit: 1
First prototype PTE: fffff8a001021f78 Last contiguous PTE: fffff8a001021ff0
Flags2: 

VAD node @ 0xfffffa800577ba10 Start 0x0000000000030000 End 0x0000000000033fff Tag Vad 
Flags: NoChange: 1, Protection: 1
Protection: PAGE_READONLY
Vad Type: VadNone
ControlArea @fffffa8005687a50 Segment fffff8a000c4f870
NumberOfSectionReferences:          1 NumberOfPfnReferences:           0
NumberOfMappedViews:               29 NumberOfUserReferences:         30
Control Flags: Commit: 1
First prototype PTE: fffff8a000c4f8b8 Last contiguous PTE: fffff8a000c4f8d0
Flags2: Inherit: 1, SecNoChange: 1
```
![10.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/9149f218-beda-8ce1-6ae4-b77ab41af495.png)

___Ans: PAGE_READONLY___

# What memory protection did the VAD starting at 0x00000000033c0000 and ending at 0x00000000033dffff have?
上記と同じくですね。`grep`のかけ方に気を付けるだけ。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 vadinfo | grep -15 "Start 0x00000000033c0000 End 0x00000000033dffff"
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
VAD node @ 0xfffffa8005ab3a50 Start 0x0000000002f10000 End 0x000000000300ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
Vad Type: VadNone

VAD node @ 0xfffffa8003c9b9a0 Start 0x0000000003250000 End 0x000000000326ffff Tag VadS
Flags: CommitCharge: 32, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS
Vad Type: VadNone

VAD node @ 0xfffffa80058d9e00 Start 0x0000000003280000 End 0x000000000337ffff Tag VadS
Flags: CommitCharge: 4, PrivateMemory: 1, Protection: 4
Protection: PAGE_READWRITE
Vad Type: VadNone

VAD node @ 0xfffffa80052652b0 Start 0x00000000033c0000 End 0x00000000033dffff Tag VadS
Flags: CommitCharge: 32, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS
Vad Type: VadNone

VAD node @ 0xfffffa8003f416d0 Start 0x00000000033a0000 End 0x00000000033bffff Tag VadS
Flags: CommitCharge: 32, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS
Vad Type: VadNone

VAD node @ 0xfffffa80056b7780 Start 0x0000000003400000 End 0x000000000341ffff Tag VadS
Flags: CommitCharge: 32, PrivateMemory: 1, Protection: 24
Protection: PAGE_NOACCESS
Vad Type: VadNone

VAD node @ 0xfffffa80045e5850 Start 0x00000000033e0000 End 0x00000000033fffff Tag VadS
```
![11.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/6e61e17c-0927-da14-2815-8de181713264.png)

___Ans: PAGE_NOACCESS___

# There was a VBS script that ran on the machine. What is the name of the script? (submit without file extension)
`cmdlist`で発見できます。`cmdscan`と同様によく使うコマンドですね。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 cmdline
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
************************************************************************
System pid:      4
************************************************************************
smss.exe pid:    252
Command line : \SystemRoot\System32\smss.exe
************************************************************************
csrss.exe pid:    332
Command line : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
************************************************************************
csrss.exe pid:    372
Command line : %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
************************************************************************
wininit.exe pid:    380
Command line : wininit.exe
************************************************************************
winlogon.exe pid:    416
Command line : winlogon.exe
************************************************************************
services.exe pid:    476
Command line : C:\Windows\system32\services.exe
************************************************************************
lsass.exe pid:    484
Command line : C:\Windows\system32\lsass.exe
************************************************************************
lsm.exe pid:    492
Command line : C:\Windows\system32\lsm.exe
************************************************************************
svchost.exe pid:    592
Command line : C:\Windows\system32\svchost.exe -k DcomLaunch
************************************************************************
svchost.exe pid:    672
Command line : C:\Windows\system32\svchost.exe -k RPCSS
************************************************************************
svchost.exe pid:    764
Command line : C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
************************************************************************
svchost.exe pid:    796
Command line : C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
************************************************************************
svchost.exe pid:    820
Command line : C:\Windows\system32\svchost.exe -k netsvcs
************************************************************************
svchost.exe pid:    932
Command line : C:\Windows\system32\svchost.exe -k LocalService
************************************************************************
svchost.exe pid:    232
Command line : C:\Windows\system32\svchost.exe -k NetworkService
************************************************************************
spoolsv.exe pid:    864
Command line : C:\Windows\System32\spoolsv.exe
************************************************************************
svchost.exe pid:   1028
Command line : C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
************************************************************************
OfficeClickToR pid:   1136
Command line : "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
************************************************************************
taskhost.exe pid:   1276
Command line : "taskhost.exe"
************************************************************************
taskeng.exe pid:   1292
Command line : taskeng.exe {E9F45B18-C0E3-42EE-9422-2FAB865F5A64}
************************************************************************
dwm.exe pid:   1344
Command line : "C:\Windows\system32\Dwm.exe"
************************************************************************
explorer.exe pid:   1432
Command line : C:\Windows\Explorer.EXE
************************************************************************
FileZilla Serv pid:   1476
Command line : "C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe"
************************************************************************
VGAuthService. pid:   1768
Command line : "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"
************************************************************************
vmtoolsd.exe pid:   1828
Command line : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" -n vmusr
************************************************************************
vmtoolsd.exe pid:   1852
Command line : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
************************************************************************
ManagementAgen pid:   1932
Command line : "C:\Program Files\VMware\VMware Tools\VMware CAF\pme\bin\ManagementAgentHost.exe"
************************************************************************
FileZilla Serv pid:   1996
Command line : "C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe" 
************************************************************************
dllhost.exe pid:   2072
Command line : C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
************************************************************************
msdtc.exe pid:   2188
Command line : C:\Windows\System32\msdtc.exe
************************************************************************
WmiPrvSE.exe pid:   2196
Command line : C:\Windows\system32\wbem\wmiprvse.exe
************************************************************************
SearchIndexer. pid:   2456
Command line : C:\Windows\system32\SearchIndexer.exe /Embedding
************************************************************************
wmpnetwk.exe pid:   2628
Command line : "C:\Program Files\Windows Media Player\wmpnetwk.exe"
************************************************************************
svchost.exe pid:   2888
Command line : C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
************************************************************************
notepad.exe pid:   3032
Command line : "C:\Windows\system32\notepad.exe" 
************************************************************************
WmiPrvSE.exe pid:   2436
Command line : C:\Windows\system32\wbem\wmiprvse.exe
************************************************************************
EXCEL.EXE pid:   1272
Command line : "C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE" 
************************************************************************
cmd.exe pid:   1408
Command line : "C:\Windows\System32\cmd.exe" 
************************************************************************
conhost.exe pid:   1008
Command line : \??\C:\Windows\system32\conhost.exe "-3665641233614004741886043129-1340869214-8780857402033447618-1868066120-1609534987
************************************************************************
taskeng.exe pid:   1156
Command line : taskeng.exe {7F35D633-1462-41D2-B75C-0C83793D50AF}
************************************************************************
sppsvc.exe pid:   3260
Command line : C:\Windows\system32\sppsvc.exe
************************************************************************
svchost.exe pid:   3300
Command line : C:\Windows\System32\svchost.exe -k secsvcs
************************************************************************
OUTLOOK.EXE pid:   3688
Command line : "C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE" 
************************************************************************
taskmgr.exe pid:   3792
Command line : "C:\Windows\system32\taskmgr.exe" /4
************************************************************************
StikyNot.exe pid:   1628
Command line : "C:\Windows\system32\StikyNot.exe" 
************************************************************************
calc.exe pid:   3548
Command line : "C:\Windows\system32\calc.exe" 
************************************************************************
iexplore.exe pid:   3576
Command line : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -Embedding
************************************************************************
iexplore.exe pid:   2780
Command line : "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:3576 CREDAT:79873
************************************************************************
hfs.exe pid:   3952
Command line : "C:\Users\Bob\Desktop\hfs.exe" 
************************************************************************
POWERPNT.EXE pid:   4048
Command line : "C:\Program Files (x86)\Microsoft Office\root\Office16\POWERPNT.EXE" 
************************************************************************
FTK Imager.exe pid:   3192
Command line : "C:\Program Files\AccessData\FTK Imager\FTK Imager.exe" 
************************************************************************
chrome.exe pid:   3248
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" 
************************************************************************
chrome.exe pid:   3244
Command line : 
************************************************************************
chrome.exe pid:   2100
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3272 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6
************************************************************************
chrome.exe pid:   1816
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=924,2132560186875629139,18153288653831290455,131072 --lang=en-US --service-sandbox-type=network --service-request-channel-token=3848528183961585196 --mojo-platform-channel-handle=1320 /prefetch:8
************************************************************************
chrome.exe pid:   4156
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=924,2132560186875629139,18153288653831290455,131072 --service-pipe-token=5128242365178584495 --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=5128242365178584495 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
************************************************************************
chrome.exe pid:   4232
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=924,2132560186875629139,18153288653831290455,131072 --service-pipe-token=16174022435611898554 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=16174022435611898554 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:1
************************************************************************
chrome.exe pid:   4240
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=924,2132560186875629139,18153288653831290455,131072 --service-pipe-token=6187966837059053897 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=6187966837059053897 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
************************************************************************
chrome.exe pid:   4520
Command line : 
************************************************************************
chrome.exe pid:   4688
Command line : "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=924,2132560186875629139,18153288653831290455,131072 --disable-gpu-compositing --service-pipe-token=2094820586012107996 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=2094820586012107996 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
************************************************************************
wscript.exe pid:   5116
Command line : "C:\Windows\System32\wscript.exe" //B //NOLOGO %TEMP%\vhjReUDEuumrX.vbs
************************************************************************
UWkpjFjDzM.exe pid:   3496
Command line : "C:\Users\Bob\AppData\Local\Temp\rad93398.tmp\UWkpjFjDzM.exe" 
************************************************************************
cmd.exe pid:   4660
Command line : C:\Windows\system32\cmd.exe
************************************************************************
conhost.exe pid:   4656
Command line : \??\C:\Windows\system32\conhost.exe "-2105419398-1914772985-1870609020-898984210-362940684623073995-430731961-49370805
```

___Ans: vhjReUDEuumrX___

# An application was run at 2019-03-07 23:06:58 UTC. What is the name of the program? (Include extension)
`shimcache`で確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 shimcache 
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
Last Modified                  Path
------------------------------ ----
2019-02-09 18:22:52 UTC+0000   \??\C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
2019-02-09 18:22:52 UTC+0000   \??\C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler64.exe
2019-02-09 18:22:52 UTC+0000   \??\C:\Program Files (x86)\Google\Update\1.3.33.23\GoogleCrashHandler.exe
2009-07-14 01:39:37 UTC+0000   \??\C:\Windows\system32\SearchProtocolHost.exe
2009-07-14 01:39:46 UTC+0000   \??\C:\Windows\system32\svchost.exe

...省略
```
面倒なので`grep`かけます。
![13.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/517cbd99-3c9b-0214-a6ad-b5188088c3d1.png)

___Ans: Skype.exe___

# What was written in notepad.exe at the time when the memory dump was captured?
3032の`memdump`を取ります。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 memdump -p 3032 -D out
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
************************************************************************
Writing notepad.exe [  3032] to 3032.dmp
```
中身を`flag`とかでgrepします。
![14.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/bffe08cc-cfb4-3522-bc09-d777baa2fd4e.png)

___Ans: flag\<REDBULL_IS_LIFE\>___

# What is the short name of the file at file record 59045?
`mftparser`で確認します。
```bash
remnux@remnux:~/Downloads$ vol.py -f Triage-Memory.mem --profile=Win7SP1x64 mftparser | grep -15 59045
Volatility Foundation Volatility Framework 2.6.1
/usr/local/lib/python2.7/dist-packages/volatility/plugins/community/YingLi/ssh_agent_key.py:12: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
  from cryptography.hazmat.backends.openssl import backend
2019-03-21 17:11:21 UTC+0000 2019-03-21 17:11:21 UTC+0000   2019-03-21 17:11:21 UTC+0000   2019-03-21 17:11:21 UTC+0000   Archive & Content not indexed

$FILE_NAME
Creation                       Modified                       MFT Altered                    Access Date                    Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-21 17:11:21 UTC+0000 2019-03-21 17:11:21 UTC+0000   2019-03-21 17:11:21 UTC+0000   2019-03-21 17:11:21 UTC+0000   Users\Bob\AppData\Local\Google\Chrome\USERDA~1\CERTIF~2\1067\_PLATF~1\all\sths\A577AC~1.STH

$FILE_NAME
Creation                       Modified                       MFT Altered                    Access Date                    Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-21 17:11:21 UTC+0000 2019-03-21 17:11:21 UTC+0000   2019-03-21 17:11:21 UTC+0000   2019-03-21 17:11:21 UTC+0000   Users\Bob\AppData\Local\Google\Chrome\USERDA~1\CERTIF~2\1067\_PLATF~1\all\sths\a577ac9ced7548dd8f025b67a241089df86e0f476ec203c2ecbedb185f282638.sth

$DATA
0000000000: 7b 22 74 72 65 65 5f 73 69 7a 65 22 3a 35 33 30   {"tree_size":530
0000000010: 35 30 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 31   50,"timestamp":1
0000000020: 35 35 33 31 36 30 39 35 39 30 34 35 2c 22 73 68   553160959045,"sh
0000000030: 61 32 35 36 5f 72 6f 6f 74 5f 68 61 73 68 22 3a   a256_root_hash":
0000000040: 22 53 33 42 2f 45 6f 55 38 4a 33 76 57 61 56 6d   "S3B/EoU8J3vWaVm
0000000050: 51 61 36 30 2b 47 53 62 67 67 4c 70 46 68 49 47   Qa60+GSbggLpFhIG
0000000060: 38 7a 36 6c 6f 56 79 49 35 39 53 30 3d 22 2c 22   8z6loVyI59S0=","
0000000070: 74 72 65 65 5f 68 65 61 64 5f 73 69 67 6e 61 74   tree_head_signat
0000000080: 75 72 65 22 3a 22 42 41 45 42 41 45 64 61 79 49   ure":"BAEBAEdayI
0000000090: 6a 58 6f 39 45 43 77 52 2b 36 71 74 71 50 43 43   jXo9ECwR+6qtqPCC
00000000a0: 37 71 35 59 42 37 35 2b 6d 31 32 56 63 63 4c 52   7q5YB75+m12VccLR
00000000b0: 73 7a 78 68 48 52 2b 72 33 38 66 48 6a 67 38 76   szxhHR+r38fHjg8v
00000000c0: 57 78 42 2f 66 31 59 44 31 75 55 45 46 54 31 62   WxB/f1YD1uUEFT1b
00000000d0: 68 38 79 33 53 41 59 6e 61 71 57 77 6f 55 46 49   h8y3SAYnaqWwoUFI
00000000e0: 76 38 63 71 44 76 78 2b 50 79 67 71 6a 76 68 42   v8cqDvx+PygqjvhB
00000000f0: 6e 5a 45 57 31 33 6d 44 76 30 2b 6a 42 6d 35 59   nZEW13mDv0+jBm5Y
0000000100: 43 68 59 36 55 4d 4b 4f 49 64 52 35 54 4d 31 35   ChY6UMKOIdR5TM15
0000000110: 72 4a 41 54 37 41 56 79 78 69 31 46 2f 36 51 36   rJAT7AVyxi1F/6Q6
--
2019-03-08 03:05:02 UTC+0000 2019-03-08 03:05:02 UTC+0000   2019-03-08 03:05:02 UTC+0000   2019-03-08 03:05:02 UTC+0000   Users\Bob\AppData\Local\Google\Chrome\USERDA~1\SAFEBR~1\CertCsdDownloadWhitelist.store

$DATA


$OBJECT_ID
Object ID: 40000000-0000-0000-0010-000000000000
Birth Volume ID: 19050000-0000-0000-1905-000000000000
Birth Object ID: 31015ed0-1900-ffff-ffff-ffff82794711
Birth Domain ID: ffffffff-8279-4711-0000-000000000000

***************************************************************************
***************************************************************************
MFT entry found at offset 0x2193d400
Attribute: In Use & File
Record Number: 59045
Link count: 2


$STANDARD_INFORMATION
Creation                       Modified                       MFT Altered                    Access Date                    Type
------------------------------ ------------------------------ ------------------------------ ------------------------------ ----
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:42 UTC+0000   Archive

$FILE_NAME
Creation                       Modified                       MFT Altered                    Access Date                    Name/Path
------------------------------ ------------------------------ ------------------------------ ------------------------------ ---------
2019-03-17 06:50:07 UTC+0000 2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:43 UTC+0000   2019-03-17 07:04:42 UTC+0000   Users\Bob\DOCUME~1\EMPLOY~1\EMPLOY~1.XLS

$FILE_NAME
Creation                       Modified                       MFT Altered                    Access Date                    Name/Path
```
![15.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c12033aa-d9d3-8bd0-61e9-d634f8502540.png)

___Ans: EMPLOY~1.XLS___

# This box was exploited and is running meterpreter. What was the infected PID?
今までの流れからあのEXEファイルでしょう。中身を見てもこのようになってますし。
![16.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/5ebacf55-0a85-3111-5086-324b8cb104e3.png)

___Ans: 3496___

# 最後に
volatility2のよい復習になります。
MFT忘れてた。。。