KAPE (Kroll Artifact Parser And Extractor) and Cado Community Edition are both great free tools for DFIR professionals. You can get a free download of KAPE here, and a free deployment of Cado Community Edition here.
Below we’ve outlined how you can use KAPE with Cado Community Edition, using a canonical example of WannaCry infecting a Windows Server install. If you’d like to follow along with this investigation yourself, you can download the test data (a KAPE collection) from our Github repo. Note: KAPE also has the ability to parse artifacts itself, but in this case, we’ve used the Cado platform.
Set up
We downloaded and ran a WannaCry sample to the desktop as “OpenMe.exe”. This isn’t how WannaCry would typically end up on a system, but it serves for the purpose of this example.
After about ten seconds, the familiar “Oops your files have been encrypted" message popped up on screen, and we ran a collection with KAPE. For this, we ticked the option to collect all artifacts and ran a collection:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image2-35.png)
KAPE has the benefit of both being fast and complete - the output for this fairly vanilla Windows system was a 65 mb zip file:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image1-41.png)
KAPE has the option to collect directly into S3, though in this case we copied it over manually and imported into the Cado platform:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image14-5.png)
Processing the Zip file takes about 10 minutes, after which we have a few leads to start with. This is a vanilla system so the execution of “OpenMe.exe” sticks out like a sore-thumb:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image13-9.png)
Pivot #1 - Time
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image15-4.png)
The root of any investigation is the “pivot", and pivoting on the execution time of “OpenMe.exe” shows a number of clearly related events:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image6-22.png)
This includes the known WannaCry indicators taskdl.exe and taskse.exe. This comes from a number of locations, such as the parsed MFT and Registry as well as more esoteric forensic artifacts such as OLE data.
Pivot #2 - On the Username “administrator”:
We can also pivot on the username. Let’s pivot from this process screen onto the user “administrator”. From here, we can quickly see process execution events:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image10-11.png)
As well as parsed out sqlite databases from Windows:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image8-17.png)
...and a bunch of other events. So let’s dive in on the period in question. We can narrow in on events from the user “administrator” from the last week pretty easily:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image3-32.png)
This returns some more relevant events:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image4-28.png)
Vs Full Disk
Obviously there is a down-side to triage collection, which is that you miss some depth. I performed a full disk capture of the same system using Cado. Acquiring full disk gives you the ability to browse, search and download any files from the impacted system:
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image5-21.png)
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image9-14.png)
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image12-9.png)
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image11-13.png)
![](https://14518100.fs1.hubspotusercontent-na1.net/hubfs/14518100/Imported_Blog_Media/image7-12.png)
More Information
You can get a free download of KAPE here, and a free deployment of Cado Community here.
Let us know how you get on!
M
More from the blog
View All PostsSubscribe to Our Blog
To stay up to date on the latest from Cado Security, subscribe to our blog today.