HOW TO ANALYSE WANNACRY RANSOMWARE USING MEMORY FORENSICS (VOLATILITY, BULK EXTRACTOR AND WIRESHARK)

Summary

In this tutorial, the presenter dives into memory forensics with the Volatility framework to analyze a ransomware attack, specifically WannaCry. The session covers the process of identifying suspicious and malicious activities through memory analysis, focusing on Windows system artifacts like processes, DLL files, mutexes, and network connections. Practical steps include using Volatility plugins, examining process trees, and extracting forensic data. The tutorial emphasizes the importance of understanding system internals and provides insights into investigating ransomware using memory dumps, analysis tools, and external utilities like Bulk Extractor and Wireshark to uncover indicators of compromise.

Takeaways

• 😀 The tutorial focuses on using memory forensics to analyze ransomware, specifically using the Volatility framework and other forensic tools.
• 😀 Understanding the operating system in question is crucial for memory forensics, as it helps identify malicious processes and abnormal system behavior.
• 😀 The tutorial emphasizes the importance of identifying suspicious processes, like task scheduler and explorer.exe variants, during a ransomware attack.
• 😀 Volatility’s `PSList` and `PS3` plugins are helpful in listing and analyzing suspicious processes that could be related to ransomware.
• 😀 Malware can hide its activities through processes that exit quickly, and tools like `PSXView` help identify such exited processes.
• 😀 DLL analysis is essential, as ransomware typically uses specific DLL files to carry out malicious activities, such as encryption or self-propagation.
• 😀 Mutexes in malware ensure that only one instance of the ransomware runs at a time, and this can be checked using Volatility’s handle analysis.
• 😀 The tutorial demonstrates how to identify and analyze registry keys that ransomware might alter, especially to ensure persistence or modify system settings.
• 😀 Network connections associated with ransomware are crucial for its operation, and tools like Bulk Extractor and Wireshark can help capture and analyze these connections.
• 😀 Dumping memory of suspicious processes allows for further analysis using reverse engineering tools, like Ghidra, to understand how the malware operates.
• 😀 A reminder is given about the importance of conducting memory forensics carefully, as interacting with live malware can pose serious security risks.

Q & A

What is the primary focus of the video tutorial?

The primary focus of the video tutorial is to demonstrate how to analyze a ransomware attack using memory forensics with the Volatility framework and other tools.

What are some of the key tools mentioned for conducting memory forensics?

The key tools mentioned for conducting memory forensics are the Volatility framework, Bulk Extractor, Wireshark, and Ghidra for reverse engineering.

What is the significance of understanding the Windows operating system when conducting memory forensics?

Understanding the Windows operating system is crucial because it helps forensic investigators identify suspicious processes, such as `services.exe` and `explorer.exe`, and distinguish them from normal system operations, ensuring accurate forensic analysis.

How does Volatility help in analyzing a ransomware attack?

Volatility helps in analyzing a ransomware attack by allowing investigators to examine the memory dump of the infected system. It provides plugins like `pslist` to list processes, `psscan` to identify exited processes, and `dlllist` to inspect DLL files, all of which help uncover forensic artifacts related to the attack.

What role do DLL files play in ransomware analysis?

DLL files in ransomware analysis can indicate malicious activity. Some DLLs might be involved in suspicious behaviors like querying or editing the Windows registry or handling encryption tasks. These are key indicators of ransomware functionality.

Why is analyzing processes and their parent-child relationships important in memory forensics?

Analyzing processes and their parent-child relationships is important because it helps identify abnormal or malicious processes. For example, if a suspicious process like `wanna_decrypted.exe` is spawned by `explorer.exe`, it could indicate ransomware activity, providing crucial forensic leads.

What is the purpose of a mutex in malware, especially ransomware?

A mutex in malware, including ransomware, ensures that only one instance of the malware runs at a time. This prevents conflicts and allows the malware to function effectively by signaling that it is active, which is a key artifact to track during analysis.

What is the significance of checking network connections during memory forensics?

Checking network connections during memory forensics is significant because ransomware often communicates with a remote command-and-control (C&C) server for further instructions. Identifying suspicious IP addresses or connections can help trace the attack's origin and its potential for self-propagation.

How does Bulk Extractor assist in identifying malicious IP addresses?

Bulk Extractor helps by scanning the memory dump and extracting indicators of compromise, including IP addresses. These IPs can be associated with the ransomware's C&C server or other malicious activities, even if the malware tries to hide them.

What is the purpose of dumping processes in memory forensics?

Dumping processes in memory forensics allows investigators to capture the exact memory state of suspicious executables. This can later be analyzed with tools like Ghidra or dynamic analysis to understand the behavior of the malware and further support forensic investigations.