Home

Awesome

<a href="https://github.com/PowerShell/PowerShell"><img src="https://img.shields.io/badge/Language-Powershell-blue"></a> <img src="https://img.shields.io/badge/Maintenance%20Level-Actively%20Developed-brightgreen"> <a href="https://github.com/evild3ad/MemProcFS-Analyzer/releases/latest"><img src="https://img.shields.io/github/v/release/evild3ad/MemProcFS-Analyzer?label=Release"></a> <a href="https://twitter.com/Evild3ad79"><img src="https://img.shields.io/twitter/follow/Evild3ad79?style=social"></a>

MemProcFS-Analyzer

MemProcFS-Analyzer.ps1 is a PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.

MemProcFS - The Memory Process File System by Ulf Frisk
https://github.com/ufrisk/MemProcFS

Features:

Download

Download the latest version of MemProcFS-Analyzer from the Releases section.

Usage

Launch Windows PowerShell (or Windows PowerShell ISE or Visual Studio Code w/ PSVersion: 5.1) as Administrator and open/run MemProcFS-Analyzer.ps1.

First-Run
Fig 1: MemProcFS-Analyzer.ps1 (First Run) → Updater.ps1

Updater
Fig 2: Updater.ps1 automatically installs/updates all dependencies (First Run)

File-Browser
Fig 3: Select your Memory Snapshot and select your pagefile.sys (Optional)

Microsoft-Internet-Symbol-Store
Fig 4: Accept Terms of Use (First Run)

MemProcFS
Fig 5: If you find MemProcFS useful, please become a sponsor at: https://github.com/sponsors/ufrisk

MountPoint
Fig 6: You can investigate the mounted memory dump by exploring drive letter

FindEvil
Fig 7: FindEvil feature and additional analytics

Processes
Fig 8: Processes

RunningAndExited
Fig 9: Running and Exited Processes

ProcessTree
Fig 10: Process Tree (GUI)

ProcessTreeSearch
Fig 11: Checking Process Tree (to find anomalies)

ProcessTreeAlerts
Fig 12: Process Tree: Alert Messages w/ Process Call Chain

PropertiesView
Fig 13: Process Tree: Properties View → Double-Click on a process or alert message

IPinfo
Fig 14: GeoIP w/ IPinfo.io

MapReport
Fig 15: Map IPs w/ IPinfo.io

EVTX
Fig 16: Processing Windows Event Logs (EVTX)

Zircolite
Fig 17: Zircolite - A standalone SIGMA-based detection tool for EVTX (Mini-GUI)

Amcache
Fig 18: Processing extracted Amcache.hve → XLSX

ShimCache
Fig 19: Processing ShimCache → XLSX

Timeline-Explorer
Fig 20: Analyze CSV output w/ Timeline Explorer (TLE)

ELK-Import
Fig 21: ELK Import

ELK-Timeline
Fig 22: Happy ELK Hunting!

Secure-Archive-Container
Fig 23: Multi-Threaded ClamAV Scan to help you finding evil! ;-)

Message-Box
Fig 24: Press OK to shutdown MemProcFS and Elastisearch/Kibana

Output
Fig 25: Secure Archive Container (PW: MemProcFS)

Introduction MemProcFS and Memory Forensics

Check out Super Easy Memory Forensics by Hiroshi Suzuki and Hisao Nashiwa.

Prerequisites

  1. Download and install the latest Dokany Library Bundle → DokanSetup.exe
    https://github.com/dokan-dev/dokany/releases/latest

  2. Download and install the latest .NET 6 Desktop Runtime (Requirement for EZTools)
    https://dotnet.microsoft.com/en-us/download/dotnet/6.0

  3. Download and install the latest Windows package of ClamAV → .msi
    https://www.clamav.net/downloads#otherversions

  4. First Time Set-Up of ClamAV
    Launch Windows PowerShell console as Administrator.
    cd "C:\Program Files\ClamAV"
    copy .\conf_examples\freshclam.conf.sample .\freshclam.conf
    copy .\conf_examples\clamd.conf.sample .\clamd.conf
    write.exe .\freshclam.conf → Comment or remove the line that says "Example".
    write.exe .\clamd.conf → Comment or remove the line that says "Example".
    https://docs.clamav.net/manual/Usage/Configuration.html#windows

  5. Optimize ClamAV scan speed performance (30% faster)
    Open "C:\Program Files\ClamAV\clamd.conf" with your text editor and search for: "Don't scan files and directories matching regex"
    ExcludePath "\\heaps\\"
    ExcludePath "\\handles\\"
    ExcludePath "\\memmap\\vad-v\\"
    ExcludePath "\\sys\\pool\\"

  6. Create your free IPinfo account [approx. 1-2 min]
    https://ipinfo.io/signup?ref=cli
    Open "MemProcFS-Analyzer.ps1" with your text editor, search for "Please insert your Access Token here" and copy/paste your access token.

  7. Install the NuGet package provider for PowerShell
    Check if NuGet is available in the package providers by running the following command:
    Get-PackageProvider -ListAvailable
    If NuGet is not installed on your system yet, you have to install it.
    Install-PackageProvider -Name NuGet -Force

  8. Make sure to comment/uncomment (selectively enable or disable) the functions you want to play with (Elasticsearch and ELKImport are disabled by default). Check out the "Main" in the bottom of the script.

  9. Done! :smiley:

Notes:

Dependencies

7-Zip 24.08 Standalone Console (2024-08-11)
https://www.7-zip.org/download.html

AmcacheParser v1.5.1.0 (.NET 6)
https://ericzimmerman.github.io/

AppCompatCacheParser v1.5.0.0 (.NET 6)
https://ericzimmerman.github.io/

ClamAV - Download → Windows → clamav-1.4.1.win.x64.msi (2024-09-04)
https://www.clamav.net/downloads

Dokany File System Library v2.2.0.1000 (2024-08-18)
https://github.com/dokan-dev/dokany/releases/latest → DokanSetup.exe

Elasticsearch 8.16.0 (2024-11-12)
https://www.elastic.co/downloads/elasticsearch

entropy v1.1 (2023-07-28)
https://github.com/merces/entropy

EvtxECmd v1.5.0.0 (.NET 6)
https://ericzimmerman.github.io/

ImportExcel v7.8.10 (2024-10-21)
https://github.com/dfinke/ImportExcel

IPinfo CLI 3.3.1 (2024-03-01)
https://github.com/ipinfo/cli

jq v1.7.1 (2023-12-13)
https://github.com/stedolan/jq

Kibana 8.16.0 (2024-11-12)
https://www.elastic.co/downloads/kibana

lnk_parser v0.2.0 (2022-08-10)
https://github.com/AbdulRhmanAlfaifi/lnk_parser

MemProcFS v5.12.6 - The Memory Process File System (2024-10-09)
https://github.com/ufrisk/MemProcFS

RECmd v2.0.0.0 (.NET 6)
https://ericzimmerman.github.io/

SBECmd v2.0.0.0 (.NET 6)
https://ericzimmerman.github.io/

xsv v0.13.0 (2018-05-12)
https://github.com/BurntSushi/xsv

YARA v4.5.2 (2024-09-10)
https://virustotal.github.io/yara/

Zircolite v2.30.1 (2024-10-13)
https://github.com/wagga40/Zircolite

Links

MemProcFS
Demo of MemProcFS with Elasticsearch
Sponsor MemProcFS Project
MemProcFS-Plugins