App Hangs processing a Win7 32bit image
Opened this issue · 10 comments
b1draper commented
Hello, I'm in a SANS class and I was trying to use your tool on one of the DFIR netlabs images. Its the one labeled "win7-32-nromanoff-memory-raw". Its really given your tool a fit. The others process just fine; but this one. Has done everything from causing Xavier to hang/become unresponsive to finally generating a report with mostly garbage. It's really weird and figured I should share.
b1draper commented
solomonsonya commented
Good morning! Thank you for the message! I have not seen that type of error
before, most likely it is an error with volatility analyzing that image.
Is there a way you can upload it and I can do analysis on my end to see
whats happening?
Thanks!
Solomon
…On Thu, Aug 18, 2022, 06:16 b1draper ***@***.***> wrote:
Hello, I'm in a SANS class and I was trying to use your tool on one of the
DFIR netlabs images. Its the one labeled "win7-32-nromanoff-memory-raw".
Its really given your tool a fit. The others process just fine; but this
one. Has done everything from causing Xavier to hang/become unresponsive to
finally generating a report with mostly garbage. It's really weird and
figured I should share.
[image: image]
<https://user-images.githubusercontent.com/44442120/185382250-57af061c-5c80-4c51-980c-9a68c8dccc79.png>
—
Reply to this email directly, view it on GitHub
<#1>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABLWKJZAPCSGLQ35MB4LEWLVZYLSFANCNFSM564ZWNUA>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
b1draper commented
Solomon,
Here ya go. I've uploaded it to my Microsoft account.
https://1drv.ms/u/s!AgfXLIKCiQ1hlh5A6xonPKdC3N_1?e=no5e02
On Thu, Aug 18, 2022 at 8:46 AM Solomon Sonya ***@***.***>
wrote:
… Good morning! Thank you for the message! I have not seen that type of error
before, most likely it is an error with volatility analyzing that image.
Is there a way you can upload it and I can do analysis on my end to see
whats happening?
Thanks!
Solomon
On Thu, Aug 18, 2022, 06:16 b1draper ***@***.***> wrote:
> Hello, I'm in a SANS class and I was trying to use your tool on one of
the
> DFIR netlabs images. Its the one labeled "win7-32-nromanoff-memory-raw".
> Its really given your tool a fit. The others process just fine; but this
> one. Has done everything from causing Xavier to hang/become unresponsive
to
> finally generating a report with mostly garbage. It's really weird and
> figured I should share.
>
> [image: image]
> <
https://user-images.githubusercontent.com/44442120/185382250-57af061c-5c80-4c51-980c-9a68c8dccc79.png
>
>
> —
> Reply to this email directly, view it on GitHub
> <
#1>,
> or unsubscribe
> <
https://github.com/notifications/unsubscribe-auth/ABLWKJZAPCSGLQ35MB4LEWLVZYLSFANCNFSM564ZWNUA
>
> .
> You are receiving this because you are subscribed to this thread.Message
> ID: ***@***.***>
>
—
Reply to this email directly, view it on GitHub
<#1 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AKTCECCUQ4F37IRI34QIDYDVZYWCPANCNFSM564ZWNUA>
.
You are receiving this because you authored the thread.Message ID:
***@***.***
com>
b1draper commented
Writing to follow up to make sure that you were able to get the memory image I sent you. Let me know if you have any questions.
Thanks for the help-
solomonsonya commented
Good day!
Thanks again for the memory sample! I ran it on my machine, however, the
analysis appears to have completed successfully. The console messages are
normal messages. This occurs at times when Volatility returns illegible
data that cannot be parsed properly by Xavier.
In your analysis, did the /export/_html/ directory provide an analysis
report for you to view the system information of the memory image?
In Xavier, I can see from your image that the Malfind Entries tab
identified suspicious processes to look at. Processes 6404 pivots nicely
to VirusTotal which shows that process to be malicious. Than viewing the
parent, child, sibling relationships, it helps to identify PID 2100 -
PSECEXSVC.EXE (also has an API Hook), a.exe, spinlock.exe and PID: 3612
svchost.exe as initial processes related to this incident.
I've posted the html analysis report on my website:
https://solomonsonya.com/cyber/memory_analysis/index.html#sans_forensics
(If the image below uploads to github correctly, I'm showing messages in
the console, that are normal messages from Xavier to you stating which
lines had parsing errors. For instance, looking at the MFT parsing errors,
you'll see why the MFT had errors.) - This is normal output.
[image: Xavier output.png]
I believe also I saw in your output that IMPSCAN had normal messages that
identified duplicate entries - this is normal. The other messages are
usually produced if an error in a line parsing occurred, but the analysis
should process the remaining data. Xavier errors if /export/_html/ does
not produce an output report (in which the first things to check would be
to ensure we have entered the correct Profile for the analysis - which you
did correctly in this analysis).
Could you send me the question prompt for this investigation of
nromanoff and I'll see if I can produce a writeup of solving the challenges
relating to the memory image analysis by this weekend if possible.
Thank you so much for the messages and please let me know if you are
encountering issues running Xavier.
Cheers and Happy Hunting!
Solomon Sonya
Twitter: @Carpenter1010
On Sun, Aug 21, 2022 at 11:49 AM Solomon Sonya ***@***.***>
wrote:
… Oh gosh, I apologize, I was checking for your response, but I didn't see
your message. I traveled currently, but will download and take a look
tomorrow. I will let you know once I get it and see whats going on. Thank
you so much!
Solomon
On Sun, Aug 21, 2022, 09:29 b1draper ***@***.***> wrote:
> Writing to follow up to make sure that you were able to get the memory
> image I sent you. Let me know if you have any questions.
> Thanks for the help-
>
> —
> Reply to this email directly, view it on GitHub
> <#1 (comment)>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/ABLWKJ434TWPCMSU2BMXF2DV2JKPHANCNFSM564ZWNUA>
> .
> You are receiving this because you commented.Message ID:
> ***@***.***
> com>
>
b1draper commented
Hello,
Thanks for the reply. It’s interesting that you were able to get the analysis to complete. I ran that memory sample probably eight times through Xavier and each time it hung at a different spot never fully completing or creating the html report. There wasn't a specific question that comes to mind. We were given (3) memory images as evidence. Being excited to use your tool I tried to run it against all 5 of the images to see what it could find as part of pre-processing the data.
Thanks for your time
…Sent from my iPhone
On Aug 25, 2022, at 12:25 AM, Solomon Sonya ***@***.***> wrote:
Good day!
Thanks again for the memory sample! I ran it on my machine, however, the
analysis appears to have completed successfully. The console messages are
normal messages. This occurs at times when Volatility returns illegible
data that cannot be parsed properly by Xavier.
In your analysis, did the /export/_html/ directory provide an analysis
report for you to view the system information of the memory image?
In Xavier, I can see from your image that the Malfind Entries tab
identified suspicious processes to look at. Processes 6404 pivots nicely
to VirusTotal which shows that process to be malicious. Than viewing the
parent, child, sibling relationships, it helps to identify PID 2100 -
PSECEXSVC.EXE (also has an API Hook), a.exe, spinlock.exe and PID: 3612
svchost.exe as initial processes related to this incident.
I've posted the html analysis report on my website:
https://solomonsonya.com/cyber/memory_analysis/index.html#sans_forensics
(If the image below uploads to github correctly, I'm showing messages in
the console, that are normal messages from Xavier to you stating which
lines had parsing errors. For instance, looking at the MFT parsing errors,
you'll see why the MFT had errors.) - This is normal output.
[image: Xavier output.png]
I believe also I saw in your output that IMPSCAN had normal messages that
identified duplicate entries - this is normal. The other messages are
usually produced if an error in a line parsing occurred, but the analysis
should process the remaining data. Xavier errors if /export/_html/ does
not produce an output report (in which the first things to check would be
to ensure we have entered the correct Profile for the analysis - which you
did correctly in this analysis).
Could you send me the question prompt for this investigation of
nromanoff and I'll see if I can produce a writeup of solving the challenges
relating to the memory image analysis by this weekend if possible.
Thank you so much for the messages and please let me know if you are
encountering issues running Xavier.
Cheers and Happy Hunting!
Solomon Sonya
Twitter: @Carpenter1010
On Sun, Aug 21, 2022 at 11:49 AM Solomon Sonya ***@***.***>
wrote:
> Oh gosh, I apologize, I was checking for your response, but I didn't see
> your message. I traveled currently, but will download and take a look
> tomorrow. I will let you know once I get it and see whats going on. Thank
> you so much!
>
> Solomon
>
> On Sun, Aug 21, 2022, 09:29 b1draper ***@***.***> wrote:
>
>> Writing to follow up to make sure that you were able to get the memory
>> image I sent you. Let me know if you have any questions.
>> Thanks for the help-
>>
>> —
>> Reply to this email directly, view it on GitHub
>> <#1 (comment)>,
>> or unsubscribe
>> <https://github.com/notifications/unsubscribe-auth/ABLWKJ434TWPCMSU2BMXF2DV2JKPHANCNFSM564ZWNUA>
>> .
>> You are receiving this because you commented.Message ID:
>> ***@***.***
>> com>
>>
>
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you authored the thread.
solomonsonya commented
I'm thinking about it again, it's mostlike a compatibility issue with the
Windows version of volatility. Right now, Xavier is most compatible only
on a Windows machine while I work to get it released for Unix as well.
You can place the image in a Google share and I can download it tonight and
see what's happening. Please DM me on Twitter @Carpenter1010 and I'll get
it and take a look. I can set up a share as well if you need.
Sorry about that. I know it won't help now, but hopefully it'll be better
with the newer volatility versions on a Unix machine once I can get Xavier
3.0 released.
Thanks again,
Solomon
…On Thu, Aug 18, 2022, 07:46 Solomon Sonya ***@***.***> wrote:
Good morning! Thank you for the message! I have not seen that type of
error before, most likely it is an error with volatility analyzing that
image.
Is there a way you can upload it and I can do analysis on my end to see
whats happening?
Thanks!
Solomon
On Thu, Aug 18, 2022, 06:16 b1draper ***@***.***> wrote:
> Hello, I'm in a SANS class and I was trying to use your tool on one of
> the DFIR netlabs images. Its the one labeled
> "win7-32-nromanoff-memory-raw". Its really given your tool a fit. The
> others process just fine; but this one. Has done everything from causing
> Xavier to hang/become unresponsive to finally generating a report with
> mostly garbage. It's really weird and figured I should share.
>
> [image: image]
> <https://user-images.githubusercontent.com/44442120/185382250-57af061c-5c80-4c51-980c-9a68c8dccc79.png>
>
> —
> Reply to this email directly, view it on GitHub
> <#1>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/ABLWKJZAPCSGLQ35MB4LEWLVZYLSFANCNFSM564ZWNUA>
> .
> You are receiving this because you are subscribed to this thread.Message
> ID: ***@***.***>
>
solomonsonya commented
No worries.
Interesting. Right now, Xavier 2.X is written to execute best on a Windows
machine. Are you by chance executing it on an OS different than a Windows
machine?
Xavier version 3 will be fully compatible with *NIX (mainly Kali and
Ubuntu), but right now Windows is the target OS that it runs on. I'm
running it on a Windows 10x64 with Java 1.8 installed, volatility 2.6x64.
Is your configuration different?
Thanks!
Solomon
…On Thu, Aug 25, 2022, 05:49 b1draper ***@***.***> wrote:
Hello,
Thanks for the reply. It’s interesting that you were able to get the
analysis to complete. I ran that memory sample probably eight times through
Xavier and each time it hung at a different spot never fully completing or
creating the html report.
Thanks for your time
Sent from my iPhone
> On Aug 25, 2022, at 12:25 AM, Solomon Sonya ***@***.***> wrote:
>
>
> Good day!
>
> Thanks again for the memory sample! I ran it on my machine, however, the
> analysis appears to have completed successfully. The console messages are
> normal messages. This occurs at times when Volatility returns illegible
> data that cannot be parsed properly by Xavier.
>
> In your analysis, did the /export/_html/ directory provide an analysis
> report for you to view the system information of the memory image?
>
> In Xavier, I can see from your image that the Malfind Entries tab
> identified suspicious processes to look at. Processes 6404 pivots nicely
> to VirusTotal which shows that process to be malicious. Than viewing the
> parent, child, sibling relationships, it helps to identify PID 2100 -
> PSECEXSVC.EXE (also has an API Hook), a.exe, spinlock.exe and PID: 3612
> svchost.exe as initial processes related to this incident.
>
> I've posted the html analysis report on my website:
> https://solomonsonya.com/cyber/memory_analysis/index.html#sans_forensics
>
> (If the image below uploads to github correctly, I'm showing messages in
> the console, that are normal messages from Xavier to you stating which
> lines had parsing errors. For instance, looking at the MFT parsing
errors,
> you'll see why the MFT had errors.) - This is normal output.
>
> [image: Xavier output.png]
>
> I believe also I saw in your output that IMPSCAN had normal messages that
> identified duplicate entries - this is normal. The other messages are
> usually produced if an error in a line parsing occurred, but the analysis
> should process the remaining data. Xavier errors if /export/_html/ does
> not produce an output report (in which the first things to check would be
> to ensure we have entered the correct Profile for the analysis - which
you
> did correctly in this analysis).
>
> Could you send me the question prompt for this investigation of
> nromanoff and I'll see if I can produce a writeup of solving the
challenges
> relating to the memory image analysis by this weekend if possible.
>
> Thank you so much for the messages and please let me know if you are
> encountering issues running Xavier.
>
> Cheers and Happy Hunting!
>
> Solomon Sonya
> Twitter: @Carpenter1010
>
> On Sun, Aug 21, 2022 at 11:49 AM Solomon Sonya ***@***.***>
> wrote:
>
> > Oh gosh, I apologize, I was checking for your response, but I didn't
see
> > your message. I traveled currently, but will download and take a look
> > tomorrow. I will let you know once I get it and see whats going on.
Thank
> > you so much!
> >
> > Solomon
> >
> > On Sun, Aug 21, 2022, 09:29 b1draper ***@***.***> wrote:
> >
> >> Writing to follow up to make sure that you were able to get the memory
> >> image I sent you. Let me know if you have any questions.
> >> Thanks for the help-
> >>
> >> —
> >> Reply to this email directly, view it on GitHub
> >> <
#1 (comment)
>,
> >> or unsubscribe
> >> <
https://github.com/notifications/unsubscribe-auth/ABLWKJ434TWPCMSU2BMXF2DV2JKPHANCNFSM564ZWNUA
>
> >> .
> >> You are receiving this because you commented.Message ID:
> >> ***@***.***
> >> com>
> >>
> >
> —
> Reply to this email directly, view it on GitHub, or unsubscribe.
> You are receiving this because you authored the thread.
—
Reply to this email directly, view it on GitHub
<#1 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABLWKJ7ARQOTDERHF3GITPTV25FSPANCNFSM564ZWNUA>
.
You are receiving this because you commented.Message ID:
***@***.***
com>
solomonsonya commented
Oh gosh, I apologize, I was checking for your response, but I didn't see
your message. I traveled currently, but will download and take a look
tomorrow. I will let you know once I get it and see whats going on. Thank
you so much!
Solomon
…On Sun, Aug 21, 2022, 09:29 b1draper ***@***.***> wrote:
Writing to follow up to make sure that you were able to get the memory
image I sent you. Let me know if you have any questions.
Thanks for the help-
—
Reply to this email directly, view it on GitHub
<#1 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABLWKJ434TWPCMSU2BMXF2DV2JKPHANCNFSM564ZWNUA>
.
You are receiving this because you commented.Message ID:
***@***.***
com>
b1draper commented
Thanks for getting back to me. I've been running it on Win10 64bit. Currently I have build 21H2. I'm also using java 1.8.0_341-b10. For every other memory image that I've tried Xavier works fine. It was just what one memory image that you looked at back August. The copy of the HTML report that you shared was very helpful. Thanks for taking the time.
Did you happen to have time to look at the other issue that I posted about the image info and how it's reflected in the html report? If you'd like please feel free to reach out to me directly at b1draper@gmail.com