Memory Forensics Analysis Paper

The original taskeng.exe file is a safe Microsoft Windows system process, called "Task Scheduler Engine". But, the user are recommended to detect Taskeng.exe by identifying same file name.

Chapter 4 in the textbook contains links to several web sites which are important to understanding computer investigations. In this section, list the web sites discussed in the chapter and include their Internet links along with a brief description of what is contained at each of these sites.

Utilizing two simple command switches, -O and -v, provided a wealth of information about the host system. Most notably, it listed all of the open ports, protocols, and the operating system of the target system. This quick gathering of information enabled the execution of more detailed commands against specific ports to expose specific vulnerabilities. This information can then be used to address any specific vulnerabilities that are

After initial intrusion malicious software is installed on victim host that is re-ferred as RAT (remote access Trojan). RAT takes the responsibility to connect with attacker and regularly performed the actions that instructed by attacker. At this intruder take the full command and control (C2) over target host. The fact is that the initial connection is established by victim host, not by the attacker [6]. This will happens mainly for two reasons: (i) organizations firewall usually allows the connections initialized by internal hosts, and (ii) this will help the attacker to not to detected easily. Because intrusion detection systems [7] can easily detect the extremely suspicious activity such as downloads from outside hosts.

First of all, I observed windows processes by using ‘Process Monitor’ application and found the suspect processes that start and stop in the short time period. Thus, the application tools that we need to use in this challenge are ProcessExplorer and ProcessMonitor. The ProcessExploere is using for comparison all of processes in assignment image OS, Windows-XP-Assignment.ova, and normal image OS, Windows-XP.ova. This tools will help us compare the different processes list between two images and lead us to easily isolate suspect processes that running in assignment image as shown in Figure 5 and Figure 6. About the ProcessMonitor, I used to observe the behaviours’ of suspect processes such as what they do, which processes they called, and/or what are the parameters they used to participate with other applications, also all of activities that they proceed, show on Figure 7. The difficult part that I found in this stage is how malware specify the targets and key for encryption. In this challenge, the new knowledge that I learnt is the malware do not need to create all code from scratch but they can build from any security application and make worst damage to social. In this case, they use gpg application also known as PGP, that the one of security application using for encrypt and sign data for secure communication and widely use in secure email

This week’s lab builds upon the previous EnCase examination concepts to introduce students to Windows Registry values that can help identify key information within an investigation. To elucidate this, the lab calls for an examination of registry entries within Jane’s (Blacksuit Computing) collected evidence image. Within this image, students are asked to locate key evidence including, the system’s local time zone at acquisition, the location and nature of browser help objects (add-ins), system start-up processes, and a list of first and last devices connected to Jane’s system. Among these, the student is also tasked with analyzing the nature of these items to identify any suspicious activities or entries contained in the evidence.

When all of a sudden, customers find a process in the Task Manager named CTF Loader, they fail to realize as to what it is. The file remains placed in the C:\Windows\SysWOW64 and it becomes difficult to determine if it is a virus or a genuine process. The file version is 6.3.9600.16384.

After gathering much information from the supervisor who received the original email in question, as well

This particular program is a Windows Trojan but what makes it unique is that it does not rely on the presence of a Windows binary file (an executable file on disk) to maintain its infection of a computer (Information on malware known as Poweliks, 2014).

Hackers created '800-098-8052' pop-ups advertising platform to earn money by spreading sponsored ads through which online traffic can be created plus they can generate pay-per-click and marketing revenue. In order to stay for a long time on a computer and to escape itself from removal, disables all the security measures like Firewall and antivirus.

CSEC 630 Lab2 -Intrusion Detection System and Protocol Analysis Lab (n.d.). University of Maryland University College. Retrieved from: https://learn.umuc.edu/d2l/common/viewFile.d2lfile/Database/NzkyMzkw/CSEC630_lab2_LEO.pdf?ou=33745

* Examine drives for evidence by running keyword searches and checking URL’s for Internet searches.

Dissect document frameworks and memory pictures to figure out whether any bizarre records, forms or suspicious system associations exist.

The goal of this case study is to follow a packet capture file to investigate the fictitious character Ann Dercover. Examining the file will show how she uses network tunneling to cover her tracks, but more importantly, it will help develop skills that can be applied to network forensics. The challenge is to determine if the DNS traffic is truly suspicious, determine the purpose of the DNS traffic, recover all possible information on the local and remote systems involved, and the risk associated with the data leaking from the organization.

This purpose of this document basically gives us a brief overview of the way of troubleshooting high session use in the Netscreen Firewalls . In other words , we can also say it shows us the way how we can proceed in analyzing the sessions in the Netscreen and finding the system (user) which creates a more number of sessions (toptalkers) and also the port where the user system is connected to the access switch with few commands .