Hello, security researchers who question everything! π
Last time, we identified the attacker’s ‘Intent’ and ‘Objective’ through AI. “Aha! This guy’s objective was ‘Information Theft (Infostealer)’ to steal our company’s blueprints and sell them to a competitor!”
So, now that we know the culprit’s objective, is the investigation over? Absolutely not. π ββοΈ In fact, the real investigation starts now. Knowing the objective means we can predict “where the culprit searched and what they touched.”
- If the objective is information theft? π You’d need to check browser history or FTP access logs.
- If the objective is ransomware? π You’d need to look at backup deletion logs or file server access records.
However, Windows has thousands of artifacts (evidence traces). We can’t check them all. So today, we’ll conduct an advanced practical session asking, “AI, the culprit’s intent is ‘this,’ so what additional evidence should I look for?”
This is a crucial step that expands your analysis scope from a single file to the entire system! π
1. 𧩠Why should we investigate ‘additional artifacts’?
Analyzing only one malware file reveals only 10% of the entire attack. Malware leaves ‘footprints’ throughout the system after execution.
- Even if the file is deleted… execution records might remain in Prefetch.
- Even if communication is cut… the hacker server address accessed might remain in the DNS cache.
- Even if login failed… brute-force attack attempts might remain in the Security Event Log (4625).
We will ask AI to “pinpoint where these footprints are located.”
2. π§ [Practical] Turning AI into a ‘Forensic Investigator’
The ‘attack intent’ we identified last time will be the input. Let’s take two common scenarios (ransomware, information theft) as examples.
π Scenario A: Information Theft
A situation where an attacker targets passwords saved in browsers or important documents.
[Prompt Input]
[Role] You are a digital forensic expert.
>
[Situation] Analysis results indicate that the primary objective of this malware is ‘browser account information and document file theft (Infostealer).’
>
[Request] Based on this attack intent, please recommend 5 Windows artifacts that the analyst must additionally investigate. For each artifact, explain in detail the ‘specific path/filename to check’ and the ‘expected traces.’
[AI’s Recommended Results] π€
π΅οΈββοΈ Additional Investigation List for Information Theft Response
>
1. Web Browser Artifacts (Web Browser Forensics)
– Path: %LocalAppData%GoogleChromeUser DataDefaultHistory (and Login Data)
– Reason: It is necessary to check if the access time of these files by the malware matches the time of the malicious activity.
2. Recent Document Access Records (LNK Files & Jumplists)
– Path: %AppData%MicrosoftWindowsRecent
– Reason: A list of important documents (e.g., blueprint.pdf, password.xlsx) opened by the attacker for exfiltration may remain.
3. Shellbags (Folder Access Records)
>
Path: HKCUSoftwareClassesLocal SettingsSoftwareMicrosoftWindowsShellBags
>
1. – Reason: If the attacker viewed specific folders (e.g., “Finance Team Shared Folder”) using File Explorer, traces will remain.
π Scenario B: Ransomware & Destruction
A situation where an attacker attempts to encrypt the system and prevent recovery.
[Prompt Input]
[Situation] Analysis results indicate that the attacker attempted ‘ransomware infection and system recovery neutralization.’
>
[Request] Please recommend system logs and artifacts that should be checked to prove the encryption time and attempts to neutralize recovery.
[AI’s Recommended Results] π€
π΅οΈββοΈ Additional Investigation List for Ransomware Response
>
1. Windows Security Event Log (Event Viewer)
>
ID: 4663 (Object Access) or 4688 (Process Creation)
>
1. – Reason: You need to look for records of requests for Write/Delete permissions on a large number of files, or vssadmin.exe execution records.
2. NTFS $MFT (Master File Table)
– Analysis Point: Check if the $STANDARD_INFORMATION attribute times of files have been massively changed in very short intervals. (File modification times are uniformly changed during encryption)
3. Registry Run Keys (Persistence)
– Path: HKCUSoftwareMicrosoftWindowsCurrentVersionRun
– Reason: Check if any values are registered to display the ransom note even after rebooting.
3. π¦ [Advanced] “So, what tools should I use?”
AI said, “Look at Prefetch,” but you can’t open it with Notepad, can you? Get AI to recommend analysis tools too.
[Additional Question] “What free forensic tools can be used to analyze ‘Shellbags’ and ‘Prefetch’ that you just recommended? Also, briefly explain how to use them.”
[AI Answer Example]
- Shellbags: ShellBags Explorer (Eric Zimmerman tools) is recommended. You can easily view folder browsing history with its GUI.
- Prefetch: Use PECmd or WinPrefetchView. You can find the number of executions and the last execution time.
4. π‘ Analyst’s Insight: AI is the ‘Map’, I am the ‘Walker’
This practical session is important because it prevents ‘Tunnel Vision.’ Analysts often focus too much on a single malware file in front of them, missing a backdoor open in the next room.
AI acts as a veteran investigative partner, advising from the side, “Wait, if this guy is a thief, you should check if the window is broken too!”
π Conclusion: Completing a Seamless Investigation!
Now, you can go beyond simply analyzing malware and perform a forensic investigation encompassing the entire system.
- Malware Analysis: Secure the culprit’s composite sketch (Completed)
- Intent Identification: Secure the motive for the crime (Completed)
- Additional Artifact Investigation: Secure hidden fingerprints at the crime scene (Completed today!)
Now there’s truly no escape. π Next time, the true finale of this long journey! We will turn your efforts into a wonderful outcome through “[Final] Automatically Generate Expert-Level Malware Analysis Reports (PDF) with AI.”
Until your analysis is perfect! Good luck! ππ
Leave a Reply