>> [BACKGROUND] In order to run that md5 deep command,
the first thing that you're going to want to do is open
up a command prompt from your forensic machine.
[NOISE] You can see it there.
We'll just run it [NOISE] as the administrator.
Now that we have that set up,
we would essentially navigate to where we have
our md5 program up and running.
I also have one on
my desktop and we have one here on this H drive.
We can navigate to our H drive
and then go into that md5 folder.
I think it's one more level down.
[NOISE] Then we would essentially want to run
the md5 64 exe since we're on
a 64-bit system and we're going to want to hash
this EnolaGay file up here that is in the E drive.
We would essentially tell it to hash
that file, EnolaGay.mem.
Here we have the directory
>> where our md5.exe program is,
>> and then we have the file that we want to hash.
Then we will hit "Enter."
Then just to save some time,
I've already done this.
You will see that it
produces a result that looks like this.
Here's our file, the H drive file,
here's the E:\EnolaGay.mem,
and this essentially is the hash of that file.
You would want to go ahead and export that out to
a notepad and then
copy that over to your notes and that way,
you have the integrity of
that file throughout the course of your investigation.
That's just a couple of different ways
to look at some of the volatile memory.
As promised,
>> I will go into the Mandiant Redline as well,
>> just so you can see what that looks like.
We'll close some of these windows
out and then we
will open up the Mandiant Redline program.
To get Mandiant Redline,
one of the things that you can do is just
Google, Mandiant Redline and
you'll go to the FireEye site.
Then from here you can fill out
your personal information and then click
"Download" and you will
receive a copy of Mandiant Redline.
It's a pretty powerful software.
It allows you to collect that volatile memory and
do that analysis in a one-stop shop,
and it's free, so I like free.
We've already got Mandiant Redline
>> installed our desktop.
>> We'll just go ahead and launch that.
Once you launch Redline,
you'll come up with this prompt.
You have a few options to choose from.
You can collect a standard collector,
you can create a comprehensive collector,
or you can create a IOC search collector.
Just for demonstration purposes,
we're going to create a standard collector
and as you look at this,
it gives you a couple of options.
You can go in and edit your script.
When looking at memory,
it will essentially look at all of
these different options that you select and
>> then you can go down and ask for
>> different hash values for
all of these different processes.
It will also acquire a memory image if you so choose.
Again, it will take a little bit of time if
that's something that you want to select,
especially if you have a machine
that has a large amount of RAM.
You can look at the disk and
choose different options under the desk,
you can look at the system.
Then you can go over and look at network.
Then the other tab has
some other types of searches that you may want to do.
Those are just some basic searches.
It really depends on what you're looking for,
how you would want to set this tool up.
But it is, again, very powerful tool for searching.
After that, you would then want to
save this collector to a location.
We would browse.
We could save this to
our forensic thumb drive if we wanted
to and then put that into
our victim's system and essentially run
the capture program in order for it to work.
We have to create a folder on the forensic thumb drive.
We'll just create a new folder.
We'll just call it Redline so we know what it is.
[NOISE] We'll hit "Select" and then we'll hit "Okay."
It then creates that portable collector package
and it gives you instructions
saying that your collector package is created and
saved to that location where we
specified on our thumb drive.
Then on the machine that
we want to audit or collect from,
you're going to run RunRedlineAudit.bat script.
Then they save perfectly on removable media.
Then the script will run and then it's going to create
essentially the result sessions 1, 2,
or 3, however many sessions that
you have going or had analyzed,
it will just depend on the number on the back of that.
Then when it's finished,
you can transfer the results back to
our analysis machine and then we
can go back in and look at
the files and folders that we have.
If we go to our forensic drive where we saved that,
we can see that we now have that folder we called
Redline and that we do
have the RunRedlineAudit batch file.
Then once we insert that into our victim machine,
we could run the Redline program
and then it would essentially
execute and produce some results for us to look at.
I've already done this just to
save some time because it is quite
time-consuming for that process to
run and we will go ahead
and look at some of these examples.
[BACKGROUND] One of the examples
that I ran was this analysis session 3.
We can just go ahead and pull that
up and it will take all
of the information that we had on our system.
I ran it on my own system so
that essentially it will identify the system here.
It says that we're running Windows 10
Professional domains and a work group,
the host name is LittleBoy and
the primary IP address is
my internal IP address of 192168.
That gives you all of that information.
Click on this and then essentially just
provides an overall view of the system.
It provides how much physical memory we have,
it provides the time that our system is in,
the identity of the processor,
uptime, how many drives we have in.
Again, the operating system,
the system directories,
product IDs, how many bits it is,
the type of user that's logged in.
Again, a very powerful tool and you can look
at essentially the services that you have running,
some of the registry keys,
the persistent registry information,
users with sids and identities.
Then you can scroll down through and
>> look at event logs, DNS history, browser history.
>> Again, it's a very powerful tool
>> and it makes the analysis of this data very easy.
I like it a lot, I use it whenever I can.
However, this shouldn't be your primary go-to
method every single time because like any tool,
something can go wrong and will go wrong.
So knowing how to do some of
these other methods is very important.
Once you have essentially at
the dump file that we created earlier,
the .mem file on our forensic drive,
if the analysis portion were to fail,
you can go back in and use some Python
scripting to essentially look
at your.mem file and
get a little bit more information
through the use of volatility.
That is an option. However,
the Mandiant Redline program will
also look at that .mem file.
Again, there's numerous options
on how to go about doing this process.
It's good to know more than one option.
It's good to use more than one tool
when you're doing your forensic investigation.
That way, you can go and
correlate some of the answers that you get.
Then some tools, they just
provide different information that
other tools can't provide and
some of them just have better user interfaces.
Again, don't just stick with one tool,
there are literally hundreds of
tools out there for you to use.