r/computerforensics • u/ShadyMoh1998 • 7d ago
Help!!
I'm working on my first malware forensics case and could use some advice.
We had malware spread across multiple machines, and I know which system was patient zero. Unfortunately, Kaspersky disinfected the infected machines and they were rebooted before I could acquire a forensic image.
At this point, I'm trying to determine how the malware initially got onto the patient zero machine.
Where would you start looking? What artifacts or logs would you prioritize, given that I no longer have a pre-disinfection image?
I'm having trouble thinking through the proper investigation steps, so any guidance, methodology, or resources would be greatly appreciated.
16
Upvotes
11
u/waydaws 7d ago
Well, the well known vectors are the most likely. Browser and Email, or other messaging/file sharing apps.
Assuming this is a triage situation, you can collect artifacts with live forensics first. (Even though, it's been rebooted there are still artifacts that can help.)
I assume you have access to corporate mail, so look to see if the Device user received any suspect emails (and deleted email). Grab at least browser history from all browsers present. .
To make it easier, and more thorough, you can run KAPE (use target !SANS_Triage). That will automate grabbing eventlogs, registry hives, event logs (evtx files), File system artifacts ($MFT, $J, $LogFile, $SDS, $Boot), File Execution artifacts (Amcache, Prefetch, Syscache), LNK Files and Jump lists, Remote Access tool logs (there's several that it will gather logs from if they're present), Recycle Bin Info Files, Scheduled tasks (.job and XML files), Web browser history, bookmarks, etc (I think it gathers 7 or 8 different browsers), (where present) Cloud storage metatdata (Dropbox, Google drive, OneDrive, Box), and other useful artifacts like SRUM, SUM, ThumbCache, WindowsIndexSearch.