Questions[forensic-analysis](server)

There is a folder with suspicious *.exe files on a Win 10 PC, and there are (external) protocols of potentially unlawful actions coming from that PC at a certain time in the past. The first suspicious action was network traffic to a sinkhole IP address typical for the Hupigon trojan, a second one (some days later) was posting an attempted scam on an Internet commerce platform.

The PC in question has been powered off by simply pulling the power cable shortly after the second action has been noticed.

Shortly afterwards, the PC was seized by local authorities (who had been notified about the second action by a potential victim of the scam).

A bootable image of the PC exists that has been pulled of the C: drive after the hard shutdown. The image already has been booted on a similar PC. A Trendmicro AV scan and subsequent Virustotal check has revealed (only) the following.

Trendmicro AV scan result:

"Proxygate" folder with executable files:

Virustotal check

What is PUP-Proxygate ("Potentially Unwanted Program")

How did I get infected with the ProxyGate adware

Internet Archive http://proxygate.net

How to Delete ProxyGate

Also, I have run a complete system scan of the system drive image of the PC in question, using Autopsy/The Sleuth Kit. However, I have no experience with further analysis using Autopsy, and would require assistance where to start:

I have the following list of event ID's that according to some AV security companies should be checked in the Event Viewer under the "Security" events:

1006, 1007, 1125, 4624, 4625, 4634, 4648, 4670, 4672, 4672, 4688, 4704, 4720, 4722, 4725, 4726, 4728, 4731, 4732, 4733, 4735, 4740, 4756, 4765, 4766, 4767, 4776, 4781, 4782, 4793, 5376, 5377

Is there any other way to look up whether any of the suspicious exe files has been active in any way at that time, and if yes, what it has been doing (e.g. opening files, accessing internet addresses etc.)?

Alternatively, is there a way to see any action of any program at the specific times in question (apart from searching Event Viewer)?

in spite of the fact that the main point of virtualization is having "containerized" environments for every instanced OS without sharing memory space, are there techniques to make forensics on either online or offline (paused) virtual machines?

Question is biased towards the fact I hope there is no such possibility, but than again, my concern is the fact that, in very layman's terms, when you pause your virtual machine, memory should be "dumped" somewhere on the host in order to restore it later.

Is it possible to access (read only) sensitive information from the VM in that case? If so, are there mitigation procedures for such events and how should they be properly applied?

With my very best,

Bruno

I've got an unresponsive Rackspace slice that has defied all attempts at accessing. I created an emergency image from this and deleted it, downloading the files that compromise the image to a local source. There are a number of files / assets I would still like to recover from this server if possible but not sure exactly what I can do with the image files, if anything.

Here's the files I have, for what its worth:

emergency_########_######_cloudserver########.tar.gz.0 (5gb)
emergency_########_######_cloudserver########.tar.gz.1 (5gb)
emergency_########_######_cloudserver########.tar.gz.2 (5gb)
emergency_########_######_cloudserver########.tar.gz.3 (50mb)
emergency_########_######_cloudserver########.yml (25kb)

Is it possible to mount this image as a drive? Are there other forensic recovery options?

I have a home server running a desktop ubuntu distribution. I found this in my crontab

* * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1

and when looking in that directory (the space after username/ is a directory name) I found a lot of scripts which are obviously doing something they shouldn't.

Before I wipe that computer and reinstall stuff, I would like to find out what caused the security breach and when it was done. So I don't open the same hole again.

What log files should I look in? The only servers that I am aware of that are running on the computer is sshd and lighttpd.

What should I do to detect if things like this happens again?

What are main steps doing forensic analysis of linux box after it was hacked?

Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other systems.. How to start searching for ways hack was done and who is responsible?