Study Case BANK OF AMERICA
Incident Overview
Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an email from a fellow co-worker that pointed to a PDF file. Upon opening, the employee did not seem to notice anything, however recently they have had unusual activity in their bank account. Company X was able to obtain a memory image of the employee’s virtual machine upon suspected infection. Company X wishes you to analyze the virtual memory and report on any suspected activities found. Questions can be found below to help in the formal report for the investigation.
Company X has contacted you to perform forensics work on a recent incident that occurred. One of their employees had received an email from a fellow co-worker that pointed to a PDF file. Upon opening, the employee did not seem to notice anything, however recently they have had unusual activity in their bank account. Company X was able to obtain a memory image of the employee’s virtual machine upon suspected infection. Company X wishes you to analyze the virtual memory and report on any suspected activities found. Questions can be found below to help in the formal report for the investigation.
Seorang karyawan bank menerima email dari teman kantornya yang salah satu isinya file pdf, ketika karyawan tadi membuka file tersebut tidak ada notifikasi apapun, tetapi kemudian setelah itu, terjadi aktifitas yang tidak biasa pada akun-akun bank di bank tersebut, anda sebagai investigator diminta untuk memberikan analisa terhadap komputer korban.
Pertanyaan :
1. List the processes that were running on the victim’s machine. Which process was most likely responsible for the initial exploit? (2pts)
2. List the sockets that were open on the victim’s machine during infection. Are there any suspicious processes that have sockets open? (4pts)
3. List any suspicious URLs that may be in the suspected process’s memory. (2pts)
4. Are there any other processes that contain URLs that may point to banking troubles? If so, what are these processes and what are the URLs? (4pts)
5. Were there any files that were able to be extracted from the initial process? How were these files extracted? (6pts)
6. If there was a file extracted from the initial process, what techniques did it use to perform the exploit? (8pts)
7. List suspicious files that were loaded by any processes on the victim’s machine. From this information, what was a possible payload of the initial exploit be that would be affecting the victim’s bank account? (2pts)
8. If any suspicious files can be extracted from an injected process, do any anti-virus products pick up the suspicious executable? What is the general result from anti-virus products? (6pts)
9. Are there any related registry entries associated with the payload? (4pts)
10. What technique was used in the initial exploit to inject code in to the other processes? (6pts)
2. List the sockets that were open on the victim’s machine during infection. Are there any suspicious processes that have sockets open? (4pts)
3. List any suspicious URLs that may be in the suspected process’s memory. (2pts)
4. Are there any other processes that contain URLs that may point to banking troubles? If so, what are these processes and what are the URLs? (4pts)
5. Were there any files that were able to be extracted from the initial process? How were these files extracted? (6pts)
6. If there was a file extracted from the initial process, what techniques did it use to perform the exploit? (8pts)
7. List suspicious files that were loaded by any processes on the victim’s machine. From this information, what was a possible payload of the initial exploit be that would be affecting the victim’s bank account? (2pts)
8. If any suspicious files can be extracted from an injected process, do any anti-virus products pick up the suspicious executable? What is the general result from anti-virus products? (6pts)
9. Are there any related registry entries associated with the payload? (4pts)
10. What technique was used in the initial exploit to inject code in to the other processes? (6pts)
Jawaban Singkat:
Ditemukan positif adanya infeksi malware pada komputer karyawan tersebut, yang berasal dari file pdf yang dikirim melalui email, dimana malware ini mempunyai potensi dapat mengakibatkan kerusakan serius terhadap sistem komputer dan pencurian data-data korban.
Jawaban Selengkapnya silakan download pdf inihttp://honeynet.org/files/Forensic_Challenge_3_-_Banking_Troubles_Solution.pdf
Analisa kasus menggunakan 5 W 1 H (who, what, when, where, why, how)
Who : DIketahui bahwa pembuat malware yaitu seseorang yang berasal darihxxp://search-network-plus.com.
What :
1. Komputer korban terinfeksi malware zeus / zbot dari file pdf pada email yang diterima.
2.Komputer korban berusaha untuk mendownload exploit dari alamat hxxp://search-network-plus.com.
3.Exploit ini jika terdownload berpotensi untuk membuka pertahanan komputer dari dalam dan mengirim file-file bank ke luar.
4.Malware ini meng inject file-file windows, sehingga semua process komputer terganggu, dan terinfeksi.
When : Berdasar analisa running process memory, waktu kejadian adalah Fri Feb 26 03:34:02 2010
Where : Komputer karyawan bank of america.
Why : Motif uang mendasari tersangka untuk mencoba melakukan tindak pidana.
How : Seorang karyawan bank of america menerima email rekan kerjanya yang berisi file pdf, ternyata file ini terdapat malware zeus yang diinject kedalamnya, malware ini menginfeksi file-file windows, dan mencoba mendownload exploit dari alamathxxp://search-network-plus.com. yang berpotensi untuk membuka akses keamanan komputer dan mengirim file-file bank.
Source :
Tidak ada komentar:
Posting Komentar