Let's Investigate: Compromised Server
Channel: A Fascinating Chap
Date: 2022-08-24

This scenario takes place circa 2012.
Acme Unlimited calls M13 Investigations again. This time they want you into investigate a potential corporate espionage case. They believe that they have been targeted by a malware attack. Their automated antivirus system flagged a computer as being infected, and they believe the infection was clean. However, they would like assistance in determining the source of the infection and determining what may have happened while the machine was under the influence of this malware.

Your job in this scenario:
Your objective is to produce a competent forensic report on your examination of the evidence, regardless of whether you’re able to locate any incriminating evidence. Document your investigation fully. In your report, answer the following questions:
1. How was the attack delivered? (Give me the filename of the infected file.) Look at the PCAP to find this.
a. What is roughly the size (in bytes or megabytes) of the malware? You can find the exact size, but if you carve the file DO NOT TRY TO EXECUTE IT!!!
2. What time did the attack occur? You will need to convert EPOCH to Gregorian date.
3. What is the IP address where the malware originated, and what is the IP address of the C&C server?
4. Where does the malware go once it has infected the system (check the timeline file)?
5. What process is the backdoor running in?
6. Did the backdoor install any other malware (check timeline and memdump.img)?
a. Which of these are most likely copies of the original backdoor, placed on the machine as insurance?
7. Were the confidential files compromised?
8. What is the username and password to the FTP server?
9. Can you locate any passwords (for the archive, backdoor, etc.?)