MemProcFS-Analyzer.ps1 is a PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.
MemProcFS - The Memory Process File System by Ulf Frisk
https://github.com/ufrisk/MemProcFS
Features:
Download the latest version of MemProcFS-Analyzer from the Releases section.
Launch Windows PowerShell (or Windows PowerShell ISE or Visual Studio Code w/ PSVersion: 5.1) as Administrator and open/run MemProcFS-Analyzer.ps1.
Fig 1: MemProcFS-Analyzer.ps1 (First Run) → Updater.ps1
Fig 2: Updater.ps1 automatically installs/updates all dependencies (First Run)
Fig 3: Select your Memory Snapshot and select your pagefile.sys (Optional)
Fig 4: Accept Terms of Use (First Run)
Fig 5: If you find MemProcFS useful, please become a sponsor at: https://github.com/sponsors/ufrisk
Fig 6: You can investigate the mounted memory dump by exploring drive letter
Fig 7: FindEvil feature and additional analytics
Fig 8: Processes
Fig 9: Running and Exited Processes
Fig 10: Process Tree (GUI)
Fig 11: Checking Process Tree (to find anomalies)
Fig 12: Process Tree: Alert Messages w/ Process Call Chain
Fig 13: Process Tree: Properties View → Double-Click on a process or alert message
Fig 14: GeoIP w/ IPinfo.io
Fig 15: Map IPs w/ IPinfo.io
Fig 16: Processing Windows Event Logs (EVTX)
Fig 17: Zircolite - A standalone SIGMA-based detection tool for EVTX (Mini-GUI)
Fig 18: Processing extracted Amcache.hve → XLSX
Fig 19: Processing ShimCache → XLSX
Fig 20: Analyze CSV output w/ Timeline Explorer (TLE)
Fig 21: ELK Import
Fig 22: Happy ELK Hunting!
Fig 23: Multi-Threaded ClamAV Scan to help you finding evil! ;-)
Fig 24: Press OK to shutdown MemProcFS and Elastisearch/Kibana
Fig 25: Secure Archive Container (PW: MemProcFS)
Check out Super Easy Memory Forensics by Hiroshi Suzuki and Hisao Nashiwa.
Download and install the latest Dokany Library Bundle → DokanSetup.exe
https://github.com/dokan-dev/dokany/releases/latest
Download and install the latest .NET 6 Desktop Runtime (Requirement for EZTools)
https://dotnet.microsoft.com/en-us/download/dotnet/6.0
Download and install the latest Windows package of ClamAV → .msi
https://www.clamav.net/downloads#otherversions
First Time Set-Up of ClamAV
Launch Windows PowerShell console as Administrator.
cd "C:\Program Files\ClamAV"
copy .\conf_examples\freshclam.conf.sample .\freshclam.conf
copy .\conf_examples\clamd.conf.sample .\clamd.conf
write.exe .\freshclam.conf
→ Comment or remove the line that says "Example".
write.exe .\clamd.conf
→ Comment or remove the line that says "Example".
https://docs.clamav.net/manual/Usage/Configuration.html#windows
Optimize ClamAV scan speed performance (30% faster)
Open "C:\Program Files\ClamAV\clamd.conf" with your text editor and search for: "Don't scan files and directories matching regex"
ExcludePath "\\heaps\\"
ExcludePath "\\handles\\"
ExcludePath "\\memmap\\vad-v\\"
ExcludePath "\\sys\\pool\\"
Create your free IPinfo account [approx. 1-2 min]
https://ipinfo.io/signup?ref=cli
Open "MemProcFS-Analyzer.ps1" with your text editor, search for "Please insert your Access Token here" and copy/paste your access token.
Install the NuGet package provider for PowerShell
Check if NuGet is available in the package providers by running the following command:
Get-PackageProvider -ListAvailable
If NuGet is not installed on your system yet, you have to install it.
Install-PackageProvider -Name NuGet -Force
Make sure to comment/uncomment (selectively enable or disable) the functions you want to play with (Elasticsearch and ELKImport are disabled by default). Check out the "Main" in the bottom of the script.
Done! :smiley:
Notes:
7-Zip 24.08 Standalone Console (2024-08-11)
https://www.7-zip.org/download.html
AmcacheParser v1.5.1.0 (.NET 6)
https://ericzimmerman.github.io/
AppCompatCacheParser v1.5.0.0 (.NET 6)
https://ericzimmerman.github.io/
ClamAV - Download → Windows → clamav-1.4.0.win.x64.msi (2024-08-15)
https://www.clamav.net/downloads
Dokany File System Library v2.2.0.1000 (2024-08-18)
https://github.com/dokan-dev/dokany/releases/latest → DokanSetup.exe
Elasticsearch 8.15.0 (2024-08-08)
https://www.elastic.co/downloads/elasticsearch
entropy v1.1 (2023-07-28)
https://github.com/merces/entropy
EvtxECmd v1.5.0.0 (.NET 6)
https://ericzimmerman.github.io/
ImportExcel v7.8.9 (2024-06-21)
https://github.com/dfinke/ImportExcel
IPinfo CLI 3.3.1 (2024-03-01)
https://github.com/ipinfo/cli
jq v1.7.1 (2023-12-13)
https://github.com/stedolan/jq
Kibana 8.15.0 (2024-08-08)
https://www.elastic.co/downloads/kibana
lnk_parser v0.2.0 (2022-08-10)
https://github.com/AbdulRhmanAlfaifi/lnk_parser
MemProcFS v5.11.4 - The Memory Process File System (2024-07-29)
https://github.com/ufrisk/MemProcFS
RECmd v2.0.0.0 (.NET 6)
https://ericzimmerman.github.io/
SBECmd v2.0.0.0 (.NET 6)
https://ericzimmerman.github.io/
xsv v0.13.0 (2018-05-12)
https://github.com/BurntSushi/xsv
YARA v4.5.1 (2024-05-25)
https://virustotal.github.io/yara/
Zircolite v2.20.0 (2024-03-29)
https://github.com/wagga40/Zircolite
MemProcFS
Demo of MemProcFS with Elasticsearch
Sponsor MemProcFS Project
MemProcFS-Plugins