# Velociraptor P3

### 1. Introduction

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FYS8U9JTdEa2esfqPoW88%2Fsetup2.png?alt=media\&token=eaae1573-e9cf-4c99-9b14-301ce6299e7a)

In this exercise we will infect a windows client with a simple malware sample and investigate it with velocirpator. This time we will search for a BOT communication and also have to analyse a network dump with wireshark

Prerequisite:

* Linux VM (<https://livecd.hacking-lab.com/>)
* Windows 10 VM (<https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/>)
* Malware sample (<https://samsclass.info/152/proj/security.zip>)
  * Password malware

If you need instructions how to setup velociraptor please go back to [Part1](https://cas-cyber.gitbook.io/cas-cybersecurity/live-response/velociraptor-p1) of this series.

Mitre Attack techniques used in this exercise:

**T1574.001**: Hijack Execution Flow: DLL Search Order Hijacking&#x20;

**T1053.005**: Scheduled Task/Job: Scheduled Task&#x20;

**T1562.001**: Impair Defenses: Disable or Modify Tools

[Original Lab](https://samsclass.info/152/proj/IR373.htm) developed by SAM BOWNE:

{% embed url="<https://samsclass.info>" %}

### 2. Install the simulated botnet

1\. Download this file: [**https://samsclass.info/152/proj/security.zip**](https://samsclass.info/152/proj/security.zip)\
2\. Right-click security.zip. Click "Extract All...". Click Extract. Use the password "malware".\
3\. Run Bginfo64.exe as administrator. When it asks questions, just close it.

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F2XbcKsUoBfSxAVSIJafi%2Fbot_01.png?alt=media&#x26;token=89965c03-20c5-43c2-8eb8-d15b9126f2a0" alt=""></div>

### 3. Ivestigation with velociraptor

First made sure that the windows box is connected to the velociraptor server:

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2Fyv772NcPg1yEHVTlAP3K%2Fvelociraptor21.png?alt=media\&token=4d78632b-af42-4de7-abe1-1882cb59cfa9)

First we want to capture some network traffic. For that we use the following artifact:

> **Windows.Network.PacketCapture**

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FiPtXiYXSWykT8l9L08iM%2Fnw_capture01.png?alt=media&#x26;token=b9c6df79-7f0d-40e4-9a9f-c429aa0a74c6" alt=""></div>

First let's run the artifact with default settings.

From the result tab copy the path of the etl file and run the artifact again.

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FdDwIgNQS0wfesujQpZ31%2Fnw_capture02.png?alt=media\&token=ca413de5-1a87-4ba0-a391-7311c15022ef)

This time we need to configure the collector:

* Uncheck **StartTrace**.
* Paste in the path to your TraceFile

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FDdfrCrcHnJDnAOvSAbIp%2Fnw_capture03.png?alt=media&#x26;token=6398d4a4-569f-4998-a4f7-13eab00b20f7" alt=""></div>

Now it took some time before we can download the pcapng file from the uploaded files tab.

![](https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2F2zdPs8LwZzz060sgKKeh%2Fnw_capture04.png?alt=media\&token=eeeca2db-e4a4-422d-9479-20677ed6ec7a)

### 4. Wireshark analysis

Let's open the network capute file with wireshark:

<div align="left"><img src="https://3977837039-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MfT0VPyK6X13Egd9pzy%2Fuploads%2FdykS1DOmWSSVfAIwHzQq%2Fwireshark01.png?alt=media&#x26;token=361404c2-c6d8-4361-a624-60061a325fe0" alt=""></div>