Context

The exercise simulated a real incident response engagement on a compromised Windows 10 workstation: a 1 GB RAM dump (3.raw) and a full disk image were acquired first, then analyzed following a documented step-by-step methodology (chain of custody, hash verification, preservation before analysis).

What was done

• Memory analysis with Volatility 2.6: profile determination (imageinfo), running process listing, active network connections, and the malfind plugin, which surfaced a suspicious injected region inside MsMpEng.exe (the Windows Defender process) - a strong indicator of process hollowing or code injection targeting the antivirus process itself.
• Deleted file recovery with TestDisk and PhotoRec on the disk image, which recovered a deleted GLPI archive, a PHP webshell (f0011328.php), and evidence of a reverse shell left behind by the attacker.
• Credential exposure: a plaintext password left on the desktop was identified during the review, illustrating a common real-world weakness alongside the technical compromise.
• Evidence handling: hash verification (MD5/SHA256) of acquired images and every artifact extracted, to preserve chain of custody throughout the exercise.

Tech stack

Status

Completed and submitted as part of the M1 SI computer forensics exam. Findings, method, and evidence were compiled into a written report.