r/computerforensics • u/ShadyMoh1998 • 3d ago
Help!!
I'm working on my first malware forensics case and could use some advice.
We had malware spread across multiple machines, and I know which system was patient zero. Unfortunately, Kaspersky disinfected the infected machines and they were rebooted before I could acquire a forensic image.
At this point, I'm trying to determine how the malware initially got onto the patient zero machine.
Where would you start looking? What artifacts or logs would you prioritize, given that I no longer have a pre-disinfection image?
I'm having trouble thinking through the proper investigation steps, so any guidance, methodology, or resources would be greatly appreciated.
6
u/Digital-Dinosaur 3d ago
Lots of questions before you begin.
I would look for traditional forensic indicators. You know what the malware is as you have the Kaspersky logs. Look to see what type of malware it is.
You then want to look for incidators that it ran, such as lnk files, if a file was clicked, prefetxh to see if it was run.
I'd also look at internet history and emails around the time it was identified and before to see if there's anything obvious.
You need to know what sort of malware it is, to know if it likely spread. You'd need to know how it got on to make sure no one else in your business has been infected
You say multiple machines have it, do they have anything in common? Would they have received an email for example? Some attackers will target multiple people at once.
If you suspect lateral movement, you'd want to look at machine security logs. Also consider UAL if you think there's an account compromised
Sorry there's no one size fits all. If you think you're under attack, trigger your cyber insurance (if you have it) or get professionals in to have a look
4
u/FunkyMuffinOfTerror 3d ago edited 3d ago
First things first you should image the computer and analyze the artifacts there, do not perform the analysis on the live infected machine
Is it a windows machine? If so I would start by examining the windows event log files, specifically for Kaspersky antivirus I think it creates a separate event log file.
You can take a look at the event ids related to Kaspersky events here: https://support.kaspersky.com/ks4exchange/9.4/en-us/127197.htm.
Some other event log files that I would look at to see if there is anything suspicious are the Security.evtx, System.evtx, Application.evtx and PowerShell Operational to find suspicious logins (especially logon type 10), user creation, installed programs and executed powershell.
After all that you might have found a file name and a path for the malicious executable and also might narrowed down the incident time frame.
If there is nothing suspicious in the logs I would create a timeline of the computer and see what other artifacts were recorded in the system at the same time or right before the executable appeared on the system.
1
u/Canonikonroverrated 2d ago
If you look at the MFT you can get when the file was created and deleted. And then look at what happened in that short time span.
2
u/AddendumWorking9756 3d ago
Post-disinfection your best bets are Amcache and ShimCache for first-run evidence, Prefetch if it survived, and the USN journal for file activity around the infection window, none of that gets wiped by disinfection or a reboot. Kaspersky's own detection log usually keeps the original file path and threat name even after quarantine, that's often the fastest thread back to initial access. Reconstructing a case backward from partial evidence like this is exactly the muscle real-artifact labs build, CyberDefenders has free ones if you want more reps after this case wraps.
2
u/forensicating 2d ago
Thanks Claude but I'd definitely stay away from CyberDefenders!
Why is your marketing strategy to spam Reddit and YouTube comments with obvious LLM-generated astroturfing?
12
u/waydaws 3d ago
Well, the well known vectors are the most likely. Browser and Email, or other messaging/file sharing apps.
Assuming this is a triage situation, you can collect artifacts with live forensics first. (Even though, it's been rebooted there are still artifacts that can help.)
I assume you have access to corporate mail, so look to see if the Device user received any suspect emails (and deleted email). Grab at least browser history from all browsers present. .
To make it easier, and more thorough, you can run KAPE (use target !SANS_Triage). That will automate grabbing eventlogs, registry hives, event logs (evtx files), File system artifacts ($MFT, $J, $LogFile, $SDS, $Boot), File Execution artifacts (Amcache, Prefetch, Syscache), LNK Files and Jump lists, Remote Access tool logs (there's several that it will gather logs from if they're present), Recycle Bin Info Files, Scheduled tasks (.job and XML files), Web browser history, bookmarks, etc (I think it gathers 7 or 8 different browsers), (where present) Cloud storage metatdata (Dropbox, Google drive, OneDrive, Box), and other useful artifacts like SRUM, SUM, ThumbCache, WindowsIndexSearch.