Which plugin again? 🧠

The useful bit here: work out what I’m looking for, then pick the plugin.

Need to find…Start here
Which file was present?filescan; recover cached content with dumpfiles where available
Which process ran?pslist, psscan, pstree, then cmdline
Which commands ran earlier?Recovered PowerShell event logs
Which process communicated externally?netscan, correlated with PID and process lifetime
Was a process injected?Handles, suspicious memory regions, and network evidence together
What did the payload do?Recovered executable, strings, and static analysis

Easy thing to forget: cmdline won’t give me every command ever run. Memory is a snapshot, and recovered files can be incomplete too. Volatility docs.

Unwrapping the gift 🎁

  1. present_for_santa.zip → click_for_present.lnk + present.vbs. The shortcut kicked off the script.
  2. The VBS hid a PowerShell downloader. Decoding notes: a GRINCH substitution and WrapPresent() picking every seventh character.
  3. evil_present.jpg was downloaded and saved as present.exe. So much for the image extension. URL: hxxp://77.74.198[.]52/destroy_christmas/evil_present.jpg.
  4. Suspected injection: present.exe (PID 3248) → svchost.exe (PID 724). C2 in my notes: 77.74.198[.]52:445.

Before calling it injection, line up the handles, suspicious memory, and socket owner. A malfind hit is a lead to check. The newer plugin path is windows.malware.malfind. Plugin docs.

What happened next

PowerShell logs were useful for the next part:

  • Log clearing: check the surviving PowerShell records for what ran and when.
  • Defender exclusion: C:\Users\Public. Cross-check the Defender config-change logs.
  • LSASS dump: PresentForNaughtyChild.exe was renamed ProcDump. Output: C:\Users\Public\stolen_gift.dmp.

I didn’t keep the exact timestamps, so this is the rough sequence rather than a finished timeline.

Keeping this for the next memory lab

Files → processes → memory → connections → logs. Picking the right artifact makes the plugin list a lot less overwhelming.