DFIR CTF: Malware Memory - Question 9

Question

For&nbsp;What is the name of the JSON file that exists inside the NetDefender directory?when running the command:vol.py -f malwarememory.vmem --profile=Win7SP1x86_23418 filescan | grep -i "NetDefender" &lt;-- Aided by Gemini for faster querying based on the possible arguments.in terms of using filescan to grep for NetDefender directory files, no JSON files were observed. I am wondering about what I am doing wrong.&nbsp;

lewismutton · Answer

Hi, have you tried using mftparser to look at the Master File Table? 😉

Forum Discussion

DFIR CTF: Malware Memory - Question 9

1 Reply

Featured Places

Help

Related Content

Mobile Malware: Anubis Malware (Offensive) - Question 8,9

Practical Malware Analysis: Demonstrate Your Skills Malware (Offensive)

Practical Malware Analysis: Static Analysis question 18

Practical Malware Analysis: Static Analysis question 19

Malware Analysis: Shlayer

Recent Discussions

AI Red Teaming: Lateral Movement and Privilege Escalation – Demonstrate Your Skills

DFIR CTF: Malware Memory - Question 9

Encoding: Demonstrate your Skills

Microsoft Sentinel SOAR: Demonstrate Your Skills

Incident Response: Application Shimming