Forensic Analysis Guide: RMM Phishing Campaign Investigation

Melissa Dixon

17 min read

Document Type: Incident Response & Forensics Scope: Post-compromise analysis of systems affected by Operation AnyTax Audience: Digital forensics analysts, incident responders, SOC teams Last Updated: September 2026

Table of Contents Pre-Analysis Checklist Evidence Preservation & Chain of Custody Memory Analysis (RAM Dump) Disk Forensics Email Header Analysis Network Traffic Analysis (PCAP) Browser Artifact Analysis Registry Analysis Event Log Analysis RMM Tool Forensics Timeline Construction Report Generation Pre-Analysis Checklist Initial Response (First 30 Minutes)

Before touching the victim system, complete this checklist:

Notify incident response team (email, call, Slack alert) Document initial observations (who reported? what time? what noticed?) Photograph the screen (capture current state, error messages, running processes) Note system state (powered on/off? network cable plugged? USB devices?) Identify the responder (name, title, contact info for chain of custody) Determine isolation method (network disconnect, power down, or full acquisition?) Secure physical access (lock door, control who touches system) Document time synchronization (is victim clock accurate? current UTC time?) Tools Required

On-Scene (Live Response):

USB drive with forensic tools (write-protected) Network cable (to isolate if needed) Laptop with SANS SIFT, Kali, or forensic suite Camera (photograph system, cables, environment) Notebook (handwritten notes, timestamps)

Lab Analysis:

Forensic workstation (dedicated, air-gapped if possible) EnCase, FTK, or open-source alternatives (Autopsy, CAINE) Memory analysis: Volatility, Rekall Network analysis: Wireshark, Zeek, Suricata Log analysis: SPLUNK, ELK, Graylog Hex editor: HxD, 010 Editor Malware analysis: IDA Pro, Ghidra, Radare2 Evidence Preservation & Chain of Custody Initial Preservation (Live System)

If system is still running (DO NOT shut down):

bash

1. Identify network connections

netstat -anob | tee network_connections.txt

2. List running processes

tasklist /v | tee running_processes.txt

3. Dump RAM to external drive (USB 3.0, preferably)

Using Belkasoft Live RAM Capturer (preferred for Windows)

Or: DumpIt, FTK Imager, Mandiant RedLine

4. Capture browser cache/history (before shutdown)

Chrome: C:\Users[USER]\AppData\Local\Google\Chrome\User Data\

Firefox: C:\Users[USER]\AppData\Roaming\Mozilla\Firefox\Profiles\

Copy to external drive

5. Capture registry hives

Use KAPE (Kroll Artifact Parser/Extractor) to collect key artifacts

Example KAPE Command (collects critical artifacts automatically):

powershell KAPE.exe --tsource C: --tdest D:\Forensics\KAPE_Output --target EvidenceOfExecution,RegistryHives,EventLogs,BrowserHistory Full Disk Acquisition

Once system is isolated:

bash

Using FTK Imager (GUI) or dd (CLI)

CLI Method (dd - Linux/Mac):

dd if=/dev/sda of=/media/usb_drive/disk_image.dd bs=4096 conv=noerror,sync status=progress

Verify hash (MD5 checksum):

md5sum /dev/sda > /media/usb_drive/disk_image.dd.md5

GUI Method (FTK Imager):

File → Create Disk Image → Select Source Drive → Choose Destination

Options: Segment size (2GB for FAT32 compatibility), compression (moderate)

Create AD1 (proprietary) or raw IMG format

Chain of Custody Form

Document everything in writing:

CHAIN OF CUSTODY FORM

Evidence ID: EV-2024-051234 Date/Time Received: May 15, 2024, 14:30 UTC Received By: Jane Analyst, ACME Security Team

ITEM DESCRIPTION:

Dell OptiPlex 7090 (Tower desktop)
Serial: D5NM4K2
Storage: 256GB SSD (Samsung 970 EVO)
MAC Address: 00:1A:2B:3C:4D:5E

INITIAL CONDITION:

Power state: ON (Windows 10 Enterprise, logged in)
Network: Connected via Ethernet to ACME-CORP network
Peripherals: USB mouse, USB keyboard (disconnected)
Last login: user@acme.local (05/15/2024, 13:47 UTC)

ACTIONS TAKEN:

14:30 - System photographed (3 angles, screen captured)
14:35 - Network isolated (unplugged Ethernet cable)
14:40 - RAM acquisition began (Belkasoft, USB external HDD)
15:10 - RAM acquisition completed (16 GB, hash verified)
15:15 - Critical artifacts extracted via KAPE
15:45 - Full disk acquisition initiated (FTK Imager)
17:20 - Disk acquisition completed (256 GB, 2 segments)
17:25 - MD5 hashes verified for all evidence
17:30 - Evidence sealed in anti-static bags, labeled
17:35 - Evidence transferred to forensic lab (Chain of Custody signed)

CUSTODIAN TIMELINE:

Jane Analyst (14:30-17:35, on-scene responder)
Bob Forensicist (17:35-present, lab analysis)

SIGNATURE BLOCKS: Received By: Jane Analyst Date: 05/15/2024 Time: 14:30 Released By: Jane Analyst Date: 05/15/2024 Time: 17:35 Received By: Bob Forensicist Date: 05/15/2024 Time: 17:45 Memory Analysis (RAM Dump) Volatility Framework Setup bash

Install Volatility 3 (latest)

pip install volatility3

Or use pre-built profiles for Windows systems

volatility3 -h # Verify installation Memory Analysis Workflow Step 1: Identify Operating System & Build bash

Analyze memory dump

volatility3 -f /path/to/memory.dmp windows.info

Output Example:

Kernel Base: 0xf80002800000

DTB: 0x1aa000

Symbols: Windows 10 / 2021H2 (Build 19044)

Step 2: Extract Running Processes bash

List all processes with full command line

volatility3 -f memory.dmp windows.pslist

Output:

PID Name Session ImageBase Offset

4 System 0 0x0000000000000000 0x000000000000

300 smss.exe 0 0xffff000002840000 0x00000000xxxx

800 csrss.exe 0 0xffff000003150000 0x00000000yyyy

1200 explorer.exe 1 0xffff000003aa0000 0x00000000zzzz

2048 AnyDesk.exe 1 0xffff0000041a0000 0x00000000aaaa

Get command lines for each process

volatility3 -f memory.dmp windows.cmdline | grep -E "AnyDesk|ScreenConnect|TeamViewer"

Example suspicious output:

AnyDesk.exe (PID 2048): "C:\Program Files\AnyDesk\AnyDesk.exe" --install-config attacker-config.ini

Step 3: Analyze Network Connections bash

Extract open sockets and connections

volatility3 -f memory.dmp windows.netscan

Output:

Protocol Src IP Src Port Dst IP Dst Port State

TCPv4 10.0.1.105 49323 185.220.101.45 80 ESTABLISHED

TCPv4 10.0.1.105 49324 193.45.67.89 443 ESTABLISHED

Correlate with PID to identify malicious process

volatility3 -f memory.dmp windows.netscan | grep "185.220.101.45"

→ Identifies C2 communication

Step 4: Extract Injected Code & DLLs bash

List DLLs loaded by suspicious process (AnyDesk PID 2048)

volatility3 -f memory.dmp windows.dlllist --pid 2048

Check for suspicious injected DLLs (look for non-standard paths)

E.g., C:\Windows\Temp\payload.dll (unusual location)

Step 5: Dump Suspicious Process Memory bash

Extract raw memory of suspicious process for offline analysis

volatility3 -f memory.dmp windows.memmap --pid 2048 --dump

Output file: pid.2048.dmp (raw memory pages)

Analyze with HxD or disassembler (IDA Pro, Ghidra)

Step 6: Search for Strings (Indicators) bash

Search memory for C2 domains, URLs, hardcoded strings

volatility3 -f memory.dmp windows.strings | grep -E "c2-control|any.run|185.220"

Potential output:

0x00007ffa3b2c4a10: "c2-control.xyz/api/register"

0x00007ffa3b2c4e20: "185.220.101.45"

0x00007ffa3b2c5100: "POST /api/check HTTP/1.1"

Step 7: Timeline Reconstruction (Volatility) bash

Generate timeline of process creation, file access, network activity

volatility3 -f memory.dmp timeliner > timeline.csv

Import into timeline analysis tool (Excel, Timeline Ninja, SuperTimeline)

Correlate with Windows Event Logs for complete picture

Memory Carving for IOCs bash

Extract all URLs from memory

strings memory.dmp | grep -E "^https?://" > urls_found.txt

Extract IP addresses

strings memory.dmp | grep -E "^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$" | sort -u > ips_found.txt

Example output (urls_found.txt):

https://any.run/tasks/a1b2c3d4e5f6/

https://c2-control.xyz/api/register

https://tax-audit-check.ca/download/report

Disk Forensics File System Analysis Timeline Analysis (Mac Timeline) bash

Use Autopsy or fls/mactime for file system timeline

CLI method:

fls -r /path/to/disk_image.dd | mactime -b bodyfile.txt > timeline.txt

This creates a chronological list of all file access times (MAC times)

Identifies what was accessed when

Search for Malware Artifacts

Typical Locations for Dropped Malware:

C:\Windows\Temp
C:\Users[USERNAME]\AppData\Local\Temp
C:\Users[USERNAME]\Downloads
C:\Users[USERNAME]\AppData\Roaming
C:\ProgramData
%TEMP% variable (various locations)

EnCase/FTK Search:

Keyword search: "CRA_2026_Tax_Compliance_Report.exe" Keyword search: "ScreenConnect", "AnyDesk", "TeamViewer" Keyword search: "c2-control.xyz", "185.220.101.45" Keyword search: "any.run/tasks" Hash search: 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d (known malware hash) Recover Deleted Files bash

Use photorec or similar to recover deleted files

photorec /d recovered_files /path/to/disk_image.dd

Look for:

- Deleted .exe files (malware)

- Deleted .ini config files (RMM settings)

- Deleted .txt logs (evidence)

RMM Tool Installation Forensics ConnectWise ScreenConnect

Installation Path:

C:\Program Files\ScreenConnect C:\Program Files (x86)\ScreenConnect

Key Forensic Artifacts:

Installation Registry Keys: HKLM\Software\ConnectWise\ScreenConnect
→ Connected Agent Settings → Server Address (point to attacker C2) → Installation Date/Time

Log Files: C:\Program Files\ScreenConnect\Logs
→ Connection logs with timestamps → Attacker IP addresses → Access duration

Config Files: C:\Program Files\ScreenConnect\config.ini → C2 server address → Authentication tokens → Custom configurations

Extraction & Analysis:

powershell

Extract ScreenConnect config

Get-ChildItem -Path "C:\Program Files\ScreenConnect" -Recurse -File | Where-Object {$_.Name -match "config|ini|log"} | Copy-Item -Destination "D:\Forensics\ScreenConnect_Artifacts"

Parse config files for attacker infrastructure

Type "C:\Program Files\ScreenConnect\config.ini" | findstr /i "server address url" AnyDesk

Installation Path:

C:\Program Files\AnyDesk C:\Program Files (x86)\AnyDesk

Key Forensic Artifacts:

Registry Keys: HKLM\Software\AnyDesk
→ Installation ID (unique per system) → License info → Custom configuration

Log Files: C:\ProgramData\AnyDesk
→ Connection logs → User authentication logs → Session timestamps

Config Files: C:\ProgramData\AnyDesk\system.conf → C2 server addresses → Unattended access settings → API keys Browser Artifacts Chrome Cache & History bash

Chrome stores artifacts here:

C:\Users[USERNAME]\AppData\Local\Google\Chrome\User Data\Default\

Key files:

- History (SQLite database)

- Cache\ (cached web pages)

- Cookies (session tokens)

- Bookmarks (JSON format)

- Last Tabs (recovery data)

Extract Chrome history

sqlite3 "C:\Users\john.doe\AppData\Local\Google\Chrome\User Data\Default\History"
"SELECT url, title, visit_time FROM urls WHERE url LIKE '%any.run%' OR url LIKE '%tax-audit%'"

Output Example:

https://any.run/tasks/a1b2c3d4e5f6/|CRA Compliance Analysis|132959387200000000

https://c2-control.xyz/api/register|[no title]|132959388920000000

Firefox Cache & History bash

Firefox stores artifacts here:

C:\Users[USERNAME]\AppData\Roaming\Mozilla\Firefox\Profiles[RANDOM].default\

Key files:

- places.sqlite (history, bookmarks)

- cache2\ (cached content)

- cookies.sqlite (session cookies)

sqlite3 "places.sqlite" "SELECT url, title, visit_date FROM moz_places WHERE url LIKE '%any.run%'" Internet Explorer/Edge C:\Users[USERNAME]\AppData\Local\Microsoft\Windows\INetCache
C:\Users[USERNAME]\AppData\Local\Microsoft\Windows\History\

Use IEHistoryView or similar tools to parse

Email Header Analysis Email Source Identification

Raw Email Header (from email client or EWS):

From: noreply@cra-audit-compliance.ca Sender: noreply@cra-audit-compliance.ca Reply-To: support@cra-compliance-check.xyz Return-Path: bounces@email-server.ru Date: Mon, 15 May 2024 14:47:00 +0000

Received: from mail.email-server.ru (mail.email-server.ru [185.220.101.40]) by mx.acme-corp.ca with SMTP id xx..xx..xx for john.doe@acme-corp.ca; Mon, 15 May 2024 14:47:00 -0400

Received: from internal.attacker-server.xyz (unknown [193.45.67.89]) by mail.email-server.ru with SMTP id yy..yy..yy for john.doe@acme-corp.ca; Mon, 15 May 2024 18:47:00 UTC

X-Originating-IP: [193.45.67.89] X-Mailer: PHPMailer 6.2 Authentication-Results: mx.acme-corp.ca; dmarc=fail reason="Policy clause mismatch" header.from=cra-audit-compliance.ca spf=neutral smtp.mailfrom=cra-audit-compliance.ca dkim=fail reason="Signature validation failed" header.d=cra-audit-compliance.ca Analysis Steps Step 1: Verify Sender Authentication ✗ DMARC FAIL: From domain (cra-audit-compliance.ca) ≠ Official CRA domain (cra.gc.ca) ✗ SPF FAIL: Return-Path (email-server.ru) not in CRA's SPF record ✗ DKIM FAIL: Signature doesn't match CRA's published keys

Conclusion: Email is spoofed/forged.

Step 2: Trace Email Path Original Sender (attacker): → 193.45.67.89 (ASN 16509, AWS) └─ internal.attacker-server.xyz (attacker control)

Mail Relay: → 185.220.101.40 (ASN 206485, UAE ISP) └─ mail.email-server.ru (compromised/bulletproof hosting)

Final Recipient: → john.doe@acme-corp.ca (ACME Corp employee) Step 3: Identify Infrastructure X-Originating-IP: [193.45.67.89] → ASN: AS16509 (Amazon Web Services) → Geolocation: Virginia, USA (AWS us-east-1) → Threat Intelligence: Known in phishing campaigns

Mail Server: mail.email-server.ru → Registered: 2022-03-01 (registrar: RuCenter) → WHOIS Privacy: Enabled → Hosting: Probably bulletproof/compromised

C2 Domain: internal.attacker-server.xyz → Registrant: John Doe [FAKE] → Registrar: NameCheap → Known Malicious: Yes (VirusTotal, URLhaus) Step 4: Extract Headers for Timeline Timestamp Server IP Address Action 2024-05-15 18:47:00 UTC internal.attacker-server.xyz 193.45.67.89 Email sent (attacker's system) 2024-05-15 18:47:30 UTC mail.email-server.ru 185.220.101.40 Email relayed 2024-05-15 14:47:00 EDT mx.acme-corp.ca - Email received by ACME Email Artifact Extraction

Export from Exchange Server:

powershell

Use Get-MessageTrace to locate email

Get-MessageTrace -SenderAddress "noreply@cra-audit-compliance.ca" -StartDate (Get-Date).AddDays(-10)

Extract full message with headers

Export-Mailbox -Identity john.doe -StartDate (Get-Date).AddDays(-10) -FilePath "D:\Forensics\email_export.pst"

Parse in forensic tool (EnCase, FTK, or Thunderbird)

Network Traffic Analysis (PCAP) PCAP Capture & Extraction

Capture from network switch/TAP:

bash

Using tcpdump

sudo tcpdump -i eth0 -w network_capture.pcap host 10.0.1.105

Using Wireshark (GUI)

Capture → Options → Select Interface → Start

Analysis in Wireshark Filter for Phishing Click (HTTP GET to Any.Run) http.request.method == "GET" && http.host == "any.run"

Output:

Time Source Dest Protocol Length Info 14:47:23 10.0.1.105 1.2.3.4 HTTP 345 GET /tasks/a1b2c3d4e5f6/ HTTP/1.1 14:47:24 1.2.3.4 10.0.1.105 HTTP 4820 HTTP/1.1 200 OK Filter for Payload Download http.response.code == 200 && http.content_type == "application/octet-stream" Filter for C2 Communication (ip.dst == 185.220.101.45 || ip.dst == 193.45.67.89 || ip.dst == 109.234.45.123) && tcp.port == 80 or tcp.port == 443

Extract C2 Beacon:

Right-click packet → Follow → TCP Stream

Output (example JSON C2 beacon):

POST /api/register HTTP/1.1 Host: c2-control.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Type: application/json Content-Length: 156

{ "uuid": "abc123def456", "hostname": "ACME-CORP-02", "domain": "acme.local", "av": "Windows Defender", "edr": null, "privileges": "admin", "os": "Windows 10 Enterprise 21H2" } Zeek IDS Analysis

Generate Zeek logs from PCAP:

bash zeek -r network_capture.pcap

This generates:

- conn.log (all connections)

- http.log (HTTP requests/responses)

- dns.log (DNS queries)

- ssl.log (TLS certificates)

- files.log (file transfers)

Analyze connections to C2:

bash zeek conn.log | grep "185.220.101.45"

Output:

ts conn_uids id.orig_h id.orig_p id.resp_h id.resp_p proto service duration bytes_in bytes_out

1715784443.627891 C0KzB4 10.0.1.105 49323 185.220.101.45 80 tcp http 42.19 2048 4096

Extract HTTP requests (potential beacons):

bash zeek http.log | grep "c2-control.xyz"

Output:

ts uid id.orig_h id.orig_p id.resp_h id.resp_p method uri status

1715784485.123456 C0KzB4 10.0.1.105 49323 185.220.101.45 80 POST /api/register 200

Browser Artifact Analysis Web History Recovery

Timeline of User Actions:

14:47:23 - User clicks link in email 14:47:25 - Browser navigates to: https://any.run/tasks/a1b2c3d4e5f6/ 14:47:30 - Any.Run page loads (JavaScript executes) 14:47:32 - Browser redirected to: https://tax-audit-check.ca/ 14:47:35 - Phishing login page displayed 14:47:45 - User types credentials (NOT captured in browser history, but keystroke logs might have) 14:47:50 - Form submitted to attacker server 14:47:55 - Redirect to: https://cra-compliance-check.xyz/download/report 14:48:05 - CRA_2026_Tax_Compliance_Report.exe download initiated 14:48:15 - File saved to: C:\Users\john.doe\Downloads\CRA_2026_Tax_Compliance_Report.exe 14:48:20 - User double-clicks downloaded file 14:48:21 - Malware executes (loader begins) Cached Content Recovery

Wireshark/FTK can extract cached files:

From PCAP analysis:

Exported Files:

/any-run/tasks/a1b2c3d4e5f6/.html (cached page)
/tax-audit-check/index.html (phishing form)
/CRA_2026_Tax_Compliance_Report.exe (payload binary) Registry Analysis Persistence Mechanisms Windows Registry Hives Location C:\Windows\System32\config\
- SAM (user accounts/passwords)
- SECURITY (security policies)
- SOFTWARE (installed software)
- SYSTEM (system settings, services)

C:\Users[USERNAME]\NTUSER.DAT

User-specific settings, installed programs RMM Tool Registry Keys

ScreenConnect Persistence:

HKLM\System\CurrentControlSet\Services\ScreenConnect ServiceName: ScreenConnect DisplayName: ScreenConnect Remote Access ImagePath: "C:\Program Files\ScreenConnect\sc.exe" Start: 2 (Automatic) ObjectName: LocalSystem (runs as SYSTEM)

HKLM\Software\ConnectWise\ScreenConnect → Server: connect.c2-control[.]xyz:8040 → Installation Date/Time: 2024-05-15 14:50:00 UTC

AnyDesk Persistence:

HKLM\System\CurrentControlSet\Services\AnyDesk ServiceName: AnyDesk DisplayName: AnyDesk Remote Desktop Access ImagePath: "C:\Program Files\AnyDesk\AnyDesk.exe" Start: 2 (Automatic)

HKCU\Software\AnyDesk
→ Unattended Access: 1 (enabled) → Custom Config: attacker-config.ini Loader Execution Registry Keys HKLM\Software\Microsoft\Windows\CurrentVersion\Run "Windows Update": "C:\Windows\Temp\update.exe" ← Suspicious "System Maintenance": "C:\Windows\System32\svchost.exe" ← Spoofed

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks → Identifies scheduled tasks for malware execution Registry Parsing (Command Line) powershell

Export registry hive for offline analysis

reg export HKLM\System "D:\Forensics\system.reg" reg export HKLM\Software "D:\Forensics\software.reg" reg export HKLM\Security "D:\Forensics\security.reg"

Parse exported hive (using regripper, similar tools)

Or import into Registry Viewer (FTK Imager)

Event Log Analysis Windows Event Viewer

Key Event Logs for RMM Investigation:

Log Event ID Description Security 4688 Process Execution Security 4689 Process Terminated Security 4618 Monitored Security Event Policy Changed System 7034 Service Crashed System 7035 Service Control Action System 7040 Service Start Type Changed Application - Application Errors Extract Relevant Events

Process Execution (Event 4688) - when malware runs:

powershell Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4688]]" | Where-Object {$_.Message -match "CRA|AnyDesk|ScreenConnect|AnyDesk|TeamViewer"} | Select-Object TimeCreated, Message | Export-Csv "D:\Forensics\process_execution.csv"

Output Example:

TimeCreated: 2024-05-15 14:48:20

Message: Process Create:

Creator Subject:

Security ID: S-1-5-21-...-500

Account Name: ACME\Administrator

Target Subject:

Security ID: S-1-0-0

Process Information:

New Process ID: 0x868

New Process Name: C:\Users\john.doe\Downloads\CRA_2026_Tax_Compliance_Report.exe

Token Elevation Type: TokenElevationTypeFull (Run As Admin)

Service Installation (System Event 7040) - when RMM service added:

powershell Get-WinEvent -LogName System -FilterXPath "*[System[EventID=7040]]" | Select-Object TimeCreated, Message | Export-Csv "D:\Forensics\service_changes.csv"

Output Example:

TimeCreated: 2024-05-15 14:50:35

Message: The start type of the ScreenConnect service has been changed from demand start to auto start

Network Connection Events (Security 5156) - outbound C2 connections:

powershell Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=5156]]" | Where-Object {$_.Message -match "185.220.101.45|c2-control"} | Select-Object TimeCreated, Message | Export-Csv "D:\Forensics\network_connections.csv" Timeline Construction from Event Logs powershell

Combine all events into single timeline

$events = @() $events += Get-WinEvent -LogName Security -FilterXPath "[System[EventID=4688]]" $events += Get-WinEvent -LogName Security -FilterXPath "[System[EventID=5156]]" $events += Get-WinEvent -LogName System -FilterXPath "*[System[EventID=7040]]"

$events | Sort-Object TimeCreated | Select-Object @{Name="Time";Expression={$.TimeCreated}}, @{Name="Event";Expression={$.Id}}, Message | Export-Csv "D:\Forensics\complete_timeline.csv" RMM Tool Forensics ScreenConnect Deep Analysis Installation Detection File: C:\Program Files\ScreenConnect\sc.exe MD5: [Extract from system] Size: 3.2 MB Created: 2024-05-15 14:50:00 UTC (matches event logs) Signed: Yes (ConnectWise code signing cert)

Installation Registry Timestamp: HKLM\System\Select\Current value = 1 → Timestamp of registry hive modification Configuration Extraction powershell

ScreenConnect stores config in registry

$config = Get-ItemProperty -Path "HKLM:\Software\ConnectWise\ScreenConnect"

$config | Select-Object -Property:

Server (C2 address)
Password (encrypted)
InstallationID (unique identifier)
ServiceName (display name)

Output Example:

Server: connect.attacker-c2.xyz:8040

InstallationID: abc123def456xyz789

ServiceName: ScreenConnect Remote Support

Connection Logs Analysis Location: C:\Program Files\ScreenConnect\Logs
Files:

Connection.log (connection history)
Svc_SessionTrace.log (session details)
ScreenConnect.log (general events)

Parse logs for attacker IP / timestamps

grep "Connected from" Connection.log

Output Example:

2024-05-15 14:51:30 Connected from 185.220.101.45 (attacker IP)

2024-05-15 14:51:35 Authenticated as: [SYSTEM]

2024-05-15 14:51:40 Session established (ID: 123456789)

2024-05-15 16:30:00 Disconnected

AnyDesk Deep Analysis Installation Detection File: C:\Program Files\AnyDesk\AnyDesk.exe MD5: [Extract from system] Size: 2.8 MB Created: 2024-05-15 14:52:00 UTC Signed: Yes (AnyDesk code signing cert) Configuration & Credentials Config Location: C:\ProgramData\AnyDesk\system.conf

Extract AnyDesk ID (unique identifier)

grep "anynet.id" /path/to/system.conf

Output: anynet.id=abc123def456xyz

Check for unattended access credentials

grep "unattended" /path/to/system.conf

Output: unattended=1 (unattended access enabled)

Extract custom C2 address (if configured)

grep "address" /path/to/system.conf Connection History Connection Log: C:\ProgramData\AnyDesk\connection_trace.txt

Timeline of remote access:

2024-05-15 14:52:30 Outgoing connection established to: [attacker C2] 2024-05-15 14:52:35 Session started 2024-05-15 14:52:40 Screen transfer began 2024-05-15 16:45:00 Session ended Timeline Construction Aggregated Forensic Timeline

Combine all data sources:

Timestamp Source ──────────── 14:47:00 UTC Email Server 14:47:05 UTC Email Gateway 14:47:23 UTC Browser History 14:47:30 UTC PCAP / DNS Log 14:47:35 UTC Browser Cache 14:47:50 UTC PCAP / HTTP.LOG 14:48:05 UTC Browser History 14:48:15 UTC PCAP 14:48:20 UTC File System 14:48:21 UTC Event Log (4688) 14:48:30 UTC Memory Analysis 14:49:00 UTC PCAP / HTTP.LOG 14:49:05 UTC Memory Analysis 14:50:35 UTC Event Log (7040) 14:50:40 UTC Registry Analysis 14:51:30 UTC RMM Logs 14:51:40 UTC Memory Analysis 15:30:00 UTC Event Log (5156) 16:00:00 UTC Event Log (5156) 16:15:00 UTC Event Log (4672) Timeline Narrative ATTACK NARRATIVE: Event Details ──────────────────────────────────────────────────────────────── Email sent from attacker From: noreply@cra-audit-compliance.ca Email received by ACME MX SpamAssassin score: 2.1 (below threshold) User clicks phishing link URL: any.run/tasks/a1b2c3d4e5f6 DNS query for any.run IP resolved to 1.2.3.4 (AWS) Phishing page cached User enters CRA SIN on fake form Credentials sent to attacker POST to tax-audit-check.ca/login Redirect to download page URL: cra-compliance-check.xyz/download Executable download initiated CRA_2026_Tax_Compliance_Report.exe (487 KB) Malware saved to disk Location: C:\Users\john.doe\Downloads
Process Execution CRA_2026_Tax_Compliance_Report.exe starts Reconnaissance module executes Checks AV, OS, network config C2 Beacon sent POST to 185.220.101.45/api/register RMM installer downloaded From c2-control.xyz Service Start Type Changed ScreenConnect set to Autostart RMM Persistence installed HKLM...\Services\ScreenConnect added Attacker connects via RMM ScreenConnect Connection.log: "Connected from 185.220.101.45" Interactive shell spawned cmd.exe process tree: ScreenConnect → cmd.exe Network recon begins nltest, nmap commands executed Lateral movement attempt Failed RDP connection to ACME-DC-01 Special Privileges Assigned Domain Admin credentials extracted

Phase 1 - Initial Compromise (14:47 - 14:48) Attacker sends spear-phishing email impersonating CRA to john.doe@acme.local Email bypasses gateway filters (weak SPF/DKIM/DMARC) User clicks link to Any.Run (14:47:23) Redirected to attacker's phishing portal (tax-audit-check.ca) User enters CRA SIN and credentials (14:47:50) Redirected to download page; CRA_2026_Tax_Compliance_Report.exe (malware) downloaded Malware executes as john.doe (unprivileged user) - 14:48:21

Phase 2 - Reconnaissance & Privilege Escalation (14:48 - 14:50) Reconnaissance module runs (checks AV: Windows Defender, EDR: None) Loader beacons home to 185.220.101.45/api/register (14:49:00) Attacker determines target is valuable; sends RMM installer ScreenConnect downloaded and installed as system service (14:50:35) Loader achieves persistence via registry run key

Phase 3 - Attacker Access & Lateral Movement (14:51 onwards) Attacker connects via ScreenConnect RMM tool (14:51:30) Gains SYSTEM-level access (due to service context) Opens command shell Begins network reconnaissance (14:51:40) Attempts lateral movement to domain controller (16:00:00) Extracts domain admin credentials via LSASS memory dump (16:15:00)

Phase 4 - Persistence & Preparation for Ransomware (16:15 - ongoing) Establishes multiple persistence mechanisms Stages ransomware payload Waits for optimal time to detonate (likely post-business hours or weekend) Report Generation Forensic Report Structure

Use this template for final deliverable:

INCIDENT FORENSICS REPORT

CASE NUMBER: EV-2024-051234 REPORT DATE: May 20, 2024 EXAMINER: Bob Forensicist, ABC Forensics Lab CASE TYPE: Ransomware Investigation (RMM Vector) CLASSIFICATION: Attorney-Client Privileged, Confidential

TABLE OF CONTENTS:

Executive Summary
Scope of Investigation
Evidence Received & Chain of Custody
Methodology
Findings
Timeline of Events
Conclusions
Recommendations
Appendices

SECTION 1 - EXECUTIVE SUMMARY: On May 15, 2024, at approximately 14:47 UTC, an employee (john.doe@acme.local) clicked a malicious link in a phishing email impersonating the Canada Revenue Agency. The click initiated a multi-stage attack resulting in the installation of AnyDesk remote access software (RMM tool) on the victim's workstation. Forensic analysis reveals that an unauthorized actor gained interactive access to the system within 4 minutes of initial compromise and subsequently moved laterally toward the domain controller.

Key findings:

Phishing email sent from 193.45.67.89 (AWS infrastructure)
Malware payload: CRA_2026_Tax_Compliance_Report.exe (Hash: 7a8b9c0d...)
RMM tool (AnyDesk) installed and connected to attacker C2: 185.220.101.45
Lateral movement attempted; domain admin credentials extracted
Dwell time: ~4 hours (from initial compromise to credential extraction)
Current status: Network isolated; investigation ongoing

[Continue with detailed findings, artifacts, timeline, etc.] Summary Checklist Memory dump acquired and analyzed (Volatility) Disk image created with hash verification File system timeline constructed (fls/mactime) Phishing email headers analyzed and traced Network PCAP captured and analyzed (Wireshark, Zeek) Browser artifacts extracted and timeline created Registry hives exported and analyzed Windows Event Logs parsed for critical events RMM tool configuration and logs analyzed Complete forensic timeline constructed Forensic report generated with findings All evidence properly tagged and stored Chain of Custody maintained throughout

End of Forensic Analysis Guide

Comments (0)

No comments yet — be the first.