> For the complete documentation index, see [llms.txt](https://cas-cyber.gitbook.io/cas-cybersecurity/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cas-cyber.gitbook.io/cas-cybersecurity/live-response/velociraptor-p3.md).

# Velociraptor P3

### 1. Introduction

![](/files/9wJfkG7eETvW0Vkkm5tr)

In this exercise we will infect a windows client with a simple malware sample and investigate it with velocirpator. This time we will search for a BOT communication and also have to analyse a network dump with wireshark

Prerequisite:

* Linux VM (<https://livecd.hacking-lab.com/>)
* Windows 10 VM (<https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/>)
* Malware sample (<https://samsclass.info/152/proj/security.zip>)
  * Password malware

If you need instructions how to setup velociraptor please go back to [Part1](/cas-cybersecurity/live-response/velociraptor-p1.md) of this series.

Mitre Attack techniques used in this exercise:

**T1574.001**: Hijack Execution Flow: DLL Search Order Hijacking&#x20;

**T1053.005**: Scheduled Task/Job: Scheduled Task&#x20;

**T1562.001**: Impair Defenses: Disable or Modify Tools

[Original Lab](https://samsclass.info/152/proj/IR373.htm) developed by SAM BOWNE:

{% embed url="<https://samsclass.info>" %}

### 2. Install the simulated botnet

1\. Download this file: [**https://samsclass.info/152/proj/security.zip**](https://samsclass.info/152/proj/security.zip)\
2\. Right-click security.zip. Click "Extract All...". Click Extract. Use the password "malware".\
3\. Run Bginfo64.exe as administrator. When it asks questions, just close it.

<div align="left"><img src="/files/9M5yKK8wLO8cCXP7STBv" alt=""></div>

### 3. Ivestigation with velociraptor

First made sure that the windows box is connected to the velociraptor server:

![](/files/1YoTWV6VsPynMsgGxtAx)

First we want to capture some network traffic. For that we use the following artifact:

> **Windows.Network.PacketCapture**

<div align="left"><img src="/files/GWrMaC7owrm7czouxPjB" alt=""></div>

First let's run the artifact with default settings.

From the result tab copy the path of the etl file and run the artifact again.

![](/files/ywIUz3shtzFLirQuLTl2)

This time we need to configure the collector:

* Uncheck **StartTrace**.
* Paste in the path to your TraceFile

<div align="left"><img src="/files/xCZXMT9znwn4R9MF896K" alt=""></div>

Now it took some time before we can download the pcapng file from the uploaded files tab.

![](/files/7JsywbyqBcBd80YYDumL)

### 4. Wireshark analysis

Let's open the network capute file with wireshark:

<div align="left"><img src="/files/AT1Y7x3fzKIcgIuGATJ9" alt=""></div>