# UCS648: Cyber Forensics
## Lab Assignment
### Arnav Barman
### 102053038
### 3COE15

---

Topics covered during analysis:
1. Image file 1
- Image Identification
- imageinfo
- Processes & DLLs
- pslist
- pstree
- psscan
- cmdscan
- handles
- malfind
- Networking
- connscan
- sockets
- Registry
- hivelist
- File System
- mbrparser

1. Image file 2
- Image Identification
- imageinfo
- Processes & DLLs
- pslist
- pstree
- psscan
- cmdscan
- handles
- consoles
- malfind
- Networking
- connscan
- sockets
- Registry
- hivelist
- File System
- mbrparser

Reference: [Volatility Foundation's Github](https://github.com/volatilityfoundation/volatility/wiki/Linux-Command-Reference)

---

## Analysis

1. Image file 1

- Image Identification: To start with our analysis, we first try to understand more about our image file.
- imageinfo: This plugin shows us that the machine whose memory dump we have was running on Windows XP SP2/3 profile.

- Processes & DLLs: We now look into all the processes in the machine memory to search for any kind of masking or some unwanted process
- pslist:

- pstree:

- psscan:
 Here we do not find any kind of masqueraded process nor any process that was not required or unusual.
- cmdscan: This command detects any command that was run through console shell via searching the csrss.exe memory, but uppon analysis nothing of suspicion was found. 

- consoles: Here we detect any commands that were run though CMD or through any kind of backdoors but we can not find any kind of suspicion here as well!
- handles: We look for open handles in processes, where we did not find any suspicion as well.

- malfind: We try to find if there is any injected code or hidden code in user mode. But this was in vain as well!

- Networking: Here we look at the network connection that our machine had.
- connscan: This plugin helps us find the remote address, local address, ports and the processes that made those connection. On analysis we see that the machie only had access to one port and that was Port 80 and that too on remote machine so it seems safe!

- sockets: We look for any protocol ports that may be open for listening but we don't find any wrong behaviour in this segment too!

- Registry
- hivelist: We check for any suspicious activity in windows registry. But all activity seems fine in the registry.

- File System
- mbrparser: We parse the memory and scan for any other master boot records. But we only see the original master boot record.

**On the basis of the above analysis, it is safe to say that there was no trojan or malware in the machine!**

---

2. Image file 2
- Image Identification: To start with our analysis, we first try to understand more about our image file.
- imageinfo: This plugin shows us that the machine whose memory dump we have was running on Windows XP SP2/3 profile.

- Processes & DLLs: We now look into all the processes in the machine memory to search for any kind of masking or some unwanted process
- pslist:

- pstree:

- psscan:
 Here we do not find any kind of masqueraded process nor any process that was not required or unusual.
- cmdscan: This command detects any command that was run through console shell via searching the csrss.exe memory, but uppon analysis nothing of suspicion was found.

- handles: We look for open handles in processes, where we did not find any suspicion as well.

- consoles: Here we detect any commands that were run though CMD or through any kind of backdoors but we can not find any kind of suspicion here as well!

- malfind: We try to find if there is any injected code or hidden code in user mode. But this was in vain as well!

- Networking: Here we look at the network connection that our machine had.
- connscan: This plugin helps us find the remote address, local address, ports and the processes that made those connection. On analysis we see that the machie only had access to one port and that was Port 80 and that too on remote machine so it seems safe!

- sockets: We look for any protocol ports that may be open for listening but we don't find any wrong behaviour in this segment too!

- Registry
- hivelist: We check for any suspicious activity in windows registry. But all activity seems fine in the registry.

- File System
- mbrparser: We parse the memory and scan for any other master boot records. But we only see the original master boot record.

**On the basis of the above analysis, it is safe to say that there was no trojan or malware in the machine!**

---