Word started PowerShell

Read a Windows memory image with Volatility 3. Use pslist and cmdline to find the document that launched a hidden PowerShell download and the URL it pulled from.

Terminal mission
Beginner
4 objectives
0 of 4 solved

Briefing

jkim’s laptop was isolated after EDR flagged a script download. Before reimaging, the responder captured RAM to cases/jkim-lt/mem.raw.

vol -f <image> windows.pslist lists processes with their parent PID. windows.cmdline shows how each one was started, including the file a program opened.

analyst@forensics-ws

forensics-ws · Memory forensics

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@forensics-ws:~/cases/jkim-lt$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.