Skip to content

Commit 1c6cd0f

Browse files
evild3adevild3ad
committed
2023-12-10
1 parent 21febbc commit 1c6cd0f

File tree

1 file changed

+58
-34
lines changed

1 file changed

+58
-34
lines changed

‎MemProcFS-Analyzer.ps1‎

Lines changed: 58 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# @copyright: Copyright (c) 2021-2023 Martin Willing. All rights reserved.
55
# @contact: Any feedback or suggestions are always welcome and much appreciated - mwilling@lethal-forensics.com
66
# @url: https://lethal-forensics.com/
7-
# @date: 2023-12-09
7+
# @date: 2023-12-10
88
#
99
#
1010
# ██╗ ███████╗████████╗██╗ ██╗ █████╗ ██╗ ███████╗ ██████╗ ██████╗ ███████╗███╗ ██╗███████╗██╗ ██████╗███████╗
@@ -266,6 +266,7 @@ $script:EvtxECmd = "$SCRIPT_DIR\Tools\EvtxECmd\EvtxECmd.exe"
266266

267267
# IPinfo CLI
268268
$script:IPinfo = "$SCRIPT_DIR\Tools\IPinfo\ipinfo.exe"
269+
$IPInfoToken = "access_token" # Please insert your Access Token here (Default: access_token)
269270

270271
# jq
271272
$script:jq = "$SCRIPT_DIR\Tools\jq\jq-win64.exe"
@@ -2684,13 +2685,20 @@ if (Test-Path "$($MemProcFS)")
26842685
else
26852686
{
26862687
# CurrentVersion
2687-
$CurrentVersion = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion.txt" | Select-Object -Skip 2
2688+
if (Test-Path "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion.txt")
2689+
{
2690+
$CurrentVersion = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion.txt" | Select-Object -Skip 2
26882691

2689-
# Major
2690-
$Major = $CurrentVersion.split('.')[0]
2692+
# Major
2693+
$Major = $CurrentVersion.split('.')[0]
26912694

2692-
# Minor
2693-
$Minor = $CurrentVersion.split('.')[1]
2695+
# Minor
2696+
$Minor = $CurrentVersion.split('.')[1]
2697+
}
2698+
else
2699+
{
2700+
Write-Host "[Error] $DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentVersion.txt does NOT exist." -ForegroundColor Red
2701+
}
26942702
}
26952703

26962704
# Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022
@@ -2706,7 +2714,14 @@ if (Test-Path "$($MemProcFS)")
27062714
$ReleaseID = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ReleaseId.txt" | Select-Object -Skip 2
27072715

27082716
# CurrentBuildNumber
2709-
[int]$CurrentBuildNumber = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber.txt" | Select-Object -Skip 2
2717+
if (Test-Path "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber.txt")
2718+
{
2719+
[int]$CurrentBuildNumber = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber.txt" | Select-Object -Skip 2
2720+
}
2721+
else
2722+
{
2723+
Write-Host "[Error] $DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CurrentBuildNumber.txt does NOT exist." -ForegroundColor Red
2724+
}
27102725

27112726
# UBR
27122727
if (Test-Path "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR.txt")
@@ -2792,36 +2807,46 @@ if (Test-Path "$($MemProcFS)")
27922807
}
27932808

27942809
# RegisteredOwner
2795-
$RegisteredOwner = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner.txt" | Select-Object -Skip 2
2796-
if ($null -ne $RegisteredOwner)
2810+
if (Test-Path "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner.txt")
27972811
{
2798-
Write-Output "[Info] RegisteredOwner: $RegisteredOwner"
2812+
$RegisteredOwner = Get-Content "$DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner.txt" | Select-Object -Skip 2
2813+
if ($null -ne $RegisteredOwner)
2814+
{
2815+
Write-Output "[Info] RegisteredOwner: $RegisteredOwner"
2816+
}
2817+
else
2818+
{
2819+
Write-Output "[Info] RegisteredOwner: --"
2820+
}
27992821
}
28002822
else
28012823
{
2802-
Write-Output "[Info] RegisteredOwner: --"
2824+
Write-Host "[Error] $DriveLetter\registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner.txt does NOT exist." -ForegroundColor Red
28032825
}
28042826

28052827
# Check if it's a Domain Controller (Active Directory)
28062828
# HKLM\System\ControlSet00$CurrentControlSet\Services\ADWS (Active Directory Domain Services)
28072829
# HKLM\System\ControlSet00$CurrentControlSet\Services\NTDS (Windows NT Directory Services)
2808-
if ((Get-ChildItem -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\services" | Select-Object -ExpandProperty FullName | Select-String -Pattern "\\ADWS" -Quiet) -And (Get-ChildItem -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\services" | Select-Object -ExpandProperty FullName | Select-String -Pattern "\\NTDS" -Quiet))
2830+
if (Test-Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\services")
28092831
{
2810-
# ProductType
2811-
# WinNT - Windows Client / Windows NT Workstation
2812-
# LanmanNT – Domain Controller
2813-
# ServerNT – Member Server / ServerNT - Windows NT Server Standalone
2814-
if (Get-Content -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\ProductOptions\ProductType.txt" | Select-Object -Skip 2 | Select-String -Pattern "LanmanNT" -Quiet)
2832+
if ((Get-ChildItem -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\services" | Select-Object -ExpandProperty FullName | Select-String -Pattern "\\ADWS" -Quiet) -And (Get-ChildItem -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\services" | Select-Object -ExpandProperty FullName | Select-String -Pattern "\\NTDS" -Quiet))
28152833
{
2816-
$ProductType = Get-Content -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\ProductOptions\ProductType.txt" | Select-Object -Skip 2
2817-
Write-Output "[Info] Product Type: Domain Controller ($ProductType)"
2818-
}
2834+
# ProductType
2835+
# WinNT - Windows Client / Windows NT Workstation
2836+
# LanmanNT – Domain Controller
2837+
# ServerNT – Member Server / ServerNT - Windows NT Server Standalone
2838+
if (Get-Content -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\ProductOptions\ProductType.txt" | Select-Object -Skip 2 | Select-String -Pattern "LanmanNT" -Quiet)
2839+
{
2840+
$ProductType = Get-Content -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\ProductOptions\ProductType.txt" | Select-Object -Skip 2
2841+
Write-Output "[Info] Product Type: Domain Controller ($ProductType)"
2842+
}
28192843

2820-
# ProductSuite
2821-
$ProductSuite = Get-Content -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\ProductOptions\ProductSuite.txt" | Select-Object -Skip 2
2822-
if ($ProductSuite)
2823-
{
2824-
Write-Output "[Info] Product Suite: $ProductSuite"
2844+
# ProductSuite
2845+
$ProductSuite = Get-Content -Path "$DriveLetter\registry\HKLM\SYSTEM\ControlSet00$CurrentControlSet\Control\ProductOptions\ProductSuite.txt" | Select-Object -Skip 2
2846+
if ($ProductSuite)
2847+
{
2848+
Write-Output "[Info] Product Suite: $ProductSuite"
2849+
}
28252850
}
28262851
}
28272852

@@ -3786,16 +3811,14 @@ if (Test-Path "$($MemProcFS)")
37863811

37873812
# Access Token
37883813
# https://ipinfo.io/signup?ref=cli
3789-
$Token = "access_token" # Please insert your Access Token here
3790-
3791-
if (!("$Token" -eq "access_token"))
3814+
if (!("$IPInfoToken" -eq "access_token"))
37923815
{
37933816
# Summarize IPs
37943817
# https://ipinfo.io/summarize-ips
3795-
Get-Content "$OUTPUT_FOLDER\sys\net\IPv4\IPv4.txt" | & $IPinfo summarize -t $Token | Out-File "$OUTPUT_FOLDER\sys\net\IPv4\IPinfo\Summary.txt"
3818+
Get-Content "$OUTPUT_FOLDER\sys\net\IPv4\IPv4.txt" | & $IPinfo summarize -t $IPInfoToken | Out-File "$OUTPUT_FOLDER\sys\net\IPv4\IPinfo\Summary.txt"
37963819

37973820
# CSV
3798-
Get-Content "$OUTPUT_FOLDER\sys\net\IPv4\IPv4.txt" | & $IPinfo --csv -t $Token | Out-File "$OUTPUT_FOLDER\sys\net\IPv4\IPinfo\IPinfo.csv"
3821+
Get-Content "$OUTPUT_FOLDER\sys\net\IPv4\IPv4.txt" | & $IPinfo --csv -t $IPInfoToken | Out-File "$OUTPUT_FOLDER\sys\net\IPv4\IPinfo\IPinfo.csv"
37993822

38003823
# XLSX
38013824
if (Get-Module -ListAvailable -Name ImportExcel)
@@ -3886,14 +3909,14 @@ if (Test-Path "$($MemProcFS)")
38863909
# https://ipinfo.io/map
38873910
Get-Content "$OUTPUT_FOLDER\sys\net\IPv6\IPv6.txt" | & $IPinfo map | Out-File "$OUTPUT_FOLDER\sys\net\IPv6\IPinfo\Map.txt"
38883911

3889-
if (!("$Token" -eq "access_token"))
3912+
if (!("$IPInfoToken" -eq "access_token"))
38903913
{
38913914
# Summarize IPs
38923915
# https://ipinfo.io/summarize-ips
3893-
Get-Content "$OUTPUT_FOLDER\sys\net\IPv6\IPv6.txt" | & $IPinfo summarize -t $Token | Out-File "$OUTPUT_FOLDER\sys\net\IPv6\IPinfo\Summary.txt"
3916+
Get-Content "$OUTPUT_FOLDER\sys\net\IPv6\IPv6.txt" | & $IPinfo summarize -t $IPInfoToken | Out-File "$OUTPUT_FOLDER\sys\net\IPv6\IPinfo\Summary.txt"
38943917

38953918
# CSV
3896-
Get-Content "$OUTPUT_FOLDER\sys\net\IPv6\IPv6.txt" | & $IPinfo --csv -t $Token | Out-File "$OUTPUT_FOLDER\sys\net\IPv6\IPinfo\IPinfo.csv"
3919+
Get-Content "$OUTPUT_FOLDER\sys\net\IPv6\IPv6.txt" | & $IPinfo --csv -t $IPInfoToken | Out-File "$OUTPUT_FOLDER\sys\net\IPv6\IPinfo\IPinfo.csv"
38973920

38983921
# XLSX
38993922
if (Get-Module -ListAvailable -Name ImportExcel)
@@ -4086,7 +4109,7 @@ if (Test-Path "$($MemProcFS)")
40864109
$Count = [string]::Format('{0:N0}',($Import | Measure-Object).Count)
40874110
if ($Count -gt 0)
40884111
{
4089-
Write-Host "[Alert] TCP on Destination Port 20 detected - May indicates File Transfer Protocol (FTP) activity ($Count)" -ForegroundColor Red
4112+
Write-Host "[Alert] TCP on Destination Port 20 detected - May indicates outgoing File Transfer Protocol (FTP) activity ($Count)" -ForegroundColor Red
40904113
New-Item "$OUTPUT_FOLDER\sys\net\Detections" -ItemType Directory -Force | Out-Null
40914114
$Import | Out-File "$OUTPUT_FOLDER\sys\net\Detections\TCP-on-Destination-Port-20.txt"
40924115
}
@@ -4293,6 +4316,7 @@ if (Test-Path "$($MemProcFS)")
42934316
if([int](& $xsv count -d "`t" "$OUTPUT_FOLDER\sys\proc\CSV\proc.csv") -gt 0)
42944317
{
42954318
Write-Output "[Info] Launching Process Tree (TreeView) ... "
4319+
Unblock-File -Path "$SCRIPT_DIR\Scripts\Get-ProcessTree\Get-ProcessTree.ps1"
42964320
Start-Process -FilePath "powershell" -NoNewWindow -ArgumentList "-NoProfile", "-File", "$SCRIPT_DIR\Scripts\Get-ProcessTree\Get-ProcessTree.ps1", "-CSVPath", "$OUTPUT_FOLDER\sys\proc\CSV\proc.csv"
42974321
Start-Sleep -Seconds 3
42984322
$Host.UI.RawUI.WindowTitle = "MemProcFS-Analyzer v1.0 - Automated Forensic Analysis of Windows Memory Dumps for DFIR"

0 commit comments

Comments
 (0)