Case study – analyzing malware infections
It’s a regular Monday morning. Sarah, a financial analyst at your company, is going through her emails. Among the emails in her inbox, she notices one that appears to be sharing memes of cats, which she loves. However, she notifies the security team about sudden popups and abnormal activities on her system after she clicked on the link.
Analysis
Since this was handed over to the DFIR team, what we do is initiate a triage image and memory dump, as we covered in Chapter 2 and 3 of this book. Using Belksoft Live RAM Capture, we will collect volatile data and KAPE to collect relevant artifacts to identify the root cause of this behavior on her system. For the sake of demonstration, we are assuming that we have direct access to Sarah’s system using the GUI and we will invoke all the utilities and tools we have learned. In reality, in the majority of cases, we depend on EDR or tools such as Velociraptor to collect artifacts...
