LETHAL-FORENSICS/MemProcFS-AnalyzerPublic

NotificationsYou must be signed in to change notification settings
Fork73
Star689

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

License

GPL-3.0 license

689 stars 73 forks Branches Tags Activity

Star

Notifications

You must be signed in to change notification settings

Branches Tags

Folders and files

Name		Name	Last commit message	Last commit date
Latest commit History 168 Commits
Screenshots		Screenshots
Scripts		Scripts
Tools		Tools
CHANGELOG.md		CHANGELOG.md
LICENSE		LICENSE
MemProcFS-Analyzer.ps1		MemProcFS-Analyzer.ps1
README.md		README.md
Updater.ps1		Updater.ps1

Repository files navigation

MemProcFS-Analyzer

MemProcFS-Analyzer.ps1 is a PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.

MemProcFS - The Memory Process File System byUlf Frisk
https://github.com/ufrisk/MemProcFS

Features:

Fast and easy memory analysis!
You can mount a memory snapshot (Raw Physical Memory Dump or Microsoft Crash Dump) like a disk image and handle the memory compression feature on Windows
Auto-Install of MemProcFS, AmcacheParser, AppCompatCacheParser, Elasticsearch, entropy, EvtxECmd, ImportExcel, IPinfo CLI, jq, Kibana, lnk_parser, RECmd, SBECmd, xsv, YARA, and Zircolite
Auto-Update of MemProcFS, AmcacheParser, AppCompatCacheParser, Elasticsearch, entropy, EvtxECmd (incl. Maps), ImportExcel, IPinfo CLI, jq, Kibana, lnk_parser, RECmd, SBECmd, xsv, YARA, and Zircolite
Update-Info when there's a new version of ClamAV or a new Dokany File System Library Bundle available
Pagefile Support
OS Fingerprinting
Scan w/ Custom YARA rules (incl. 423 rules by e.g.Chronicle andElastic Security)
Multi-Threaded scan w/ ClamAV for Windows
Collection of infected files detected by ClamAV for further analysis (PW: infected)
Collection of injected modules detected by MemProcFS PE_INJECT for further analysis (PW: infected)
Extracting IPv4/IPv6
IP2ASN Mapping and GeoIP w/IPinfo CLI → Get your token for free athttps://ipinfo.io/signup
Checking for Suspicious Port Numbers
Process Tree (TreeView) including complete Process Call Chain (Special thanks toDominik Schmidt)
Checking Processes for Unusual Parent-Child Relationships and Number of Instances
Checking Processes for Unusual User Context
Checking for Process Path Masquerading and Process Name Masquerading (Damerau Levenshtein Distance)
Web Browser History (Google Chrome, Microsoft Edge and Firefox)
Extracting Windows Event Log Files and processing w/ EvtxECmd → Timeline Explorer (EZTools by Eric Zimmerman)
Event Log Overview
Processing Windows Event Logs w/Zircolite - A standalone SIGMA-based detection tool for EVTX
Analyzing extracted Amcache.hve w/ Amcacheparser (EZTools by Eric Zimmerman)
Analyzing Application Compatibility Cache aka ShimCache w/ AppCompatcacheParser (EZTools by Eric Zimmerman)
Analyzing Syscache w/ RECmd (EZTools by Eric Zimmerman)
Analyzing UserAssist Artifacts w/ RECmd (EZTools by Eric Zimmerman)
Analyzing ShellBags Artifacts w/ RECmd (EZTools by Eric Zimmerman)
Simple Prefetch View (based on Forensic Timeline)
Analyzing Auto-Start Extensibility Points (ASEPs) w/ RECmd (EZTools by Eric Zimmerman)
Analyzing RecentDocs, Office Trusted Document w/ RECmd (EZTools by Eric Zimmerman)
Analyzing Registry w/ DFIR RECmd Batch File (DFIR Batch File by Andrew Rathbun)
Analyzing Metadata of Recovered Process Modules (experimental)
Extracting Windows Shortcut Files (LNK)
Hunting Malicious Windows Shortcut Files (LNK)
Integration of PowerShell moduleImportExcel by Doug Finke
CSV output data for analysis w/ Timeline Explorer (e.g. timeline-reverse.csv, findevil.csv, web.csv)
Collecting Evidence Files (Secure Archive Container → PW: MemProcFS)
and much more

Download

Download the latest version ofMemProcFS-Analyzer from theReleases section.

Usage

Launch Windows PowerShell (or Windows PowerShell ISE or Visual Studio Code w/ PSVersion: 5.1) as Administrator and open/run MemProcFS-Analyzer.ps1.

Fig 1: Select your Memory Snapshot and select your pagefile.sys (Optional)

Fig 2: MemProcFS-Analyzer auto-installs dependencies (First Run)

Fig 3: Accept Terms of Use (First Run)

Fig 4: If you find MemProcFS useful, please become a sponsor at:https://github.com/sponsors/ufrisk

Fig 5: You can investigate the mounted memory dump by exploring drive letter

Fig 6: MemProcFS-Analyzer checks for updates (Second Run)

Note: It's recommended to uncomment/disable the "Updater" function after installation. Check out the "Main" in the bottom of the script.

Fig 7: FindEvil feature and additional analytics

Fig 8: Processes

Fig 9: Running and Exited Processes

Fig 10: Process Tree (GUI)

Fig 11: Checking Process Tree (to find anomalies)

Fig 12: Process Tree: Alert Messages w/ Process Call Chain

Fig 13: Process Tree: Properties View → Double-Click on a process or alert message

Fig 14: GeoIP w/ IPinfo.io

Fig 15: Map IPs w/ IPinfo.io

Fig 16: Processing Windows Event Logs (EVTX)

Fig 17: Zircolite - A standalone SIGMA-based detection tool for EVTX (Mini-GUI)

Fig 18: Processing extracted Amcache.hve → XLSX

Fig 19: Processing ShimCache → XLSX

Fig 20: Analyze CSV output w/ Timeline Explorer (TLE)

Fig 21: ELK Import

Fig 22: Happy ELK Hunting!

Fig 23: Multi-Threaded ClamAV Scan to help you finding evil! ;-)

Fig 24: PressOK to shutdown MemProcFS and Elastisearch/Kibana

Fig 25: Secure Archive Container (PW: MemProcFS)

Introduction MemProcFS and Memory Forensics

Check outSuper Easy Memory Forensics byHiroshi Suzuki andHisao Nashiwa.

Prerequisites

Download and install the latest Dokany Library Bundle → DokanSetup.exe
https://github.com/dokan-dev/dokany/releases/latest
Download and install the latest .NET 9 Desktop Runtime (Requirement forEZTools)
https://dotnet.microsoft.com/en-us/download/dotnet/9.0
Download and install the latest Windows package of ClamAV.
https://www.clamav.net/downloads#otherversions
First Time Set-Up of ClamAV
Launch Windows PowerShell console as Administrator.
cd "C:\Program Files\ClamAV"
copy .\conf_examples\freshclam.conf.sample .\freshclam.conf
copy .\conf_examples\clamd.conf.sample .\clamd.conf
write.exe .\freshclam.conf → Comment or remove the line that says "Example".
write.exe .\clamd.conf → Comment or remove the line that says "Example".
https://docs.clamav.net/manual/Usage/Configuration.html#windows
Optimize ClamAV scan speed performance (30% faster)
Open "C:\Program Files\ClamAV\clamd.conf" with your text editor and search for: "Don't scan files and directories matching regex"
ExcludePath "\\heaps\\"
ExcludePath "\\handles\\"
ExcludePath "\\memmap\\vad-v\\"
ExcludePath "\\sys\\pool\\"
Create your free IPinfo account [approx. 1-2 min]
https://ipinfo.io/signup?ref=cli
Open "MemProcFS-Analyzer.ps1" with your text editor, search for "Please insert your Access Token here" and copy/paste your access token.
Install the NuGet package provider for PowerShell
Check if NuGet is available in the package providers by running the following command:
Get-PackageProvider -ListAvailable
If NuGet is not installed on your system yet, you have to install it.
Install-PackageProvider -Name NuGet -Force
Make sure to comment/uncomment (selectively enable or disable) the functions you want to play with (Elasticsearch and ELKImport are disabled by default). Check out the "Main" in the bottom of the script.
Launch the Automated Installer/Updater for MemProcFS-Analyzer
.\Updater.ps1
Done! 😃