Summary

This was certainly an intense chapter! We learned how to detect running processes and connections using p0f and also did some investigation using swap_digger, which revealed useful artifacts such as passwords within the paging file of a live Linux system. We then also used MimiPenguin to try dumping the current password of the system.

We then moved on to the very exciting topic of malware analysis where we discovered embedded malicious files within a PDF using pdf-parser and PDFiD, and I also introduced you to an online tool at hybrid-analysis.com, which I frequently use to analyze suspicious files and URLs.

Finally, we carried out an exciting lab, performing ransomware analysis using the incredibly useful Volatility 3 tool, where we found processes belonging to the WannaCry ransomware and, upon further analysis, were able to pinpoint the infected user, paths, documents, and other processes.

Next up, we will delve a bit more into automated file analysis using the Autopsy...