Ransomware analysis using Volatility 3

For our last section, let’s revisit the very powerful RAM analysis tool called Volatility 3, which we covered in Chapter 10, Memory Forensics and Analysis with Volatility 3. Feel free to take a moment to review that chapter before moving ahead.

In this lab, we’ll be using a memory dump called wcry.raw, which contains information about a WannaCry ransomware infection on a Windows system. We will be analyzing it using a variety of Volatility 3 plugins.

Let’s first download and extract our sample memory dump, which we will later move to our Volatility installation folder for analysis:

1. The WannaCry memory dump file can be downloaded from https://mega.nz/file/7Z1ySZBT#KX5ZJKYzQgDHSa72lPFwqKL6CsZS7oQGbyyQrMTH9XY.

I’ve downloaded the WannaCry memory dump file to my Downloads folder, which is named wannacry pw- infected.7z.

2. To extract the file, right-click on the .7z file and click on Extract Here...