# Reveal Lab First Of All to Answer This Endpoint Forensics Machine We looking for The Ps-List to determine what happened here BTW so after installing Volatility 3 From this Repository \ \ I use "-f " Paremeter and after that i give it the location of the file and use "windows.pstree" to determine the Ps-list and export it and there is the full command

```bash python3 vol.py -f /home/kimo/Desktop/192-Reveal.dmp windows.pstree > /home/kimo/Desktop/Reveal.txt ``` ## 1- To identify The Malicious Process I dived into the file and here we go from the PPID and the Name of the process i fell it is "4120" the process Id Which Mean it\`s new Process Created and Secondly The most popular script Runner "Powershell.exe" and in the command i found IP and toke it to Virus total to identify it and Simply It\`s Malicious

## 2- In This Question It Simply Asked For the PPID which is determined from the Previous Question

## 3- The Filename Used by the Malware to execute the second payload Still in the same Line and it\`s dll file because we Communicate With Powershell every Small info Will lead you to the important info btw

## 4- We stillI in the same command and the shared Folder simply it will be after the Ip the Malware communicated With (:

## 5- He Want here the Sub Mitre Id So what the Main technique used here it\`s Defense Evasion and after that the sub stage Payload used a dll file to execute so here we go

## 6- To determine the username i used Volatility again but with User assist plugin and determine the username Easily Uncle Elon was Comprised i think the attacker send him a mail to win iPhone 16 (:

## 7- Here I used Threat Fox to determine the name

> Thanks for reading (: --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://karim-ashraf.gitbook.io/karim_ashraf_space/writeups/cyberdefenders-labs/reveal-lab.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.