# BlackEnergy

**Q1 Which volatility profile would be best for this machine?**

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FpRYQeGrjeZHTR8O3wNSL%2Fimage.png?alt=media&#x26;token=0fb4cc00-b461-4cd5-b554-4a4dfb6c28d2" alt=""><figcaption></figcaption></figure>

**Answer :** WinXPSP2x86

**Q2 How many processes were running when the image was acquired?**

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FBEZkA6rrxlOP2QKWnIgt%2Fimage.png?alt=media&#x26;token=9cfb008a-fc3f-4024-99e3-c12eb708cd67" alt=""><figcaption><p>Not contain the process have exit column -> this process is exit , not running</p></figcaption></figure>

Answer : 19

**Q3 What is the process ID of cmd.exe?**

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FbgBBz7ezansFMyskx8Wk%2Fimage.png?alt=media&#x26;token=9459a593-ee8d-4891-83e3-bf4126978f11" alt=""><figcaption></figcaption></figure>

**Answer : 1960**

**Q4 What is the name of the most suspicious process?**

The process is from previous picture too. ( rootkit is suspicious)

Answer : rootkit.exe

**Q5 Which process shows the highest likelihood of code injection?**

The process is from previous picture too.&#x20;

Answer : svchost.exe

**Q6 There is an odd file referenced in the recent process. Provide the full path of that file?**

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F5c7bg9w5ZeUB6a177jme%2Fimage.png?alt=media&#x26;token=9bd9eeaa-f555-43e1-93b1-8a6f496027e5" alt=""><figcaption><p>dump the handler and option file from it </p></figcaption></figure>

Answer : C:\WINDOWS\system32\drivers\str.sys

**Q7 What is the name of the injected dll file loaded from the recent process?**

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FlNfnqL3foeemqEpbrn0G%2Fimage.png?alt=media&#x26;token=1f469e70-79ff-4a9a-9ca1-cd78da504862" alt=""><figcaption></figcaption></figure>

**Answer :** msxml3r.dll

**Q8 What is the base address of the injected dll?**

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F3ZGSC9rMqf4p6RCdl6Bm%2Fimage.png?alt=media&#x26;token=3a4a2d02-d306-42de-874f-c6b416748929" alt=""><figcaption></figcaption></figure>

Answer : 0x980000
