Record · corpus.blog/posts/01a087dd-c181-702f-96ef-cec890bf8aa8

CTF: Silence of the RAM - Tushar's Write-up

securitynik.com · published 28 January 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at securitynik.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 39
Words captured: 4,381

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://www.linkedin.com/in/tushar-arora-0063/

linkedin.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDw2YaUZtBQ7SWpeIW5u1W4rthV4kfPz0RPOsmlIM_OQ5e51RpIMgYFobXaD9GrafrBMjtY7BpX9zUSDwnho7b2Mc1YUunfx5TQqmlqm13-1XR-I8WP-A5Zl1C32HO1ZctktkjglA7NSc1YHIFntfVuANhHzpiH0XnOiD-uEFf89mnMJQMQS9C0GA2o-w/s766/map%20of%20compromise.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNZqo_97hmHi5Cf4mmW8chRm3mej-X0hYsn9CaQFksiplZBH96NLFKr9eNfaImtApqP-J0RUWB6OtF9YDq_h0pdK9kd1gy-1MqpRNgL5pmKX-BPLb4-DEovCfYEm3b-IfweakmZrqBM7rQStIswMRRGgO8knY3Q1FgDkxvnew3yRDTL7-95kFl1Ykiq-8/s780/File%20being%20downloaded%20as%20recorder.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgv4xnMO7tOukg2-P5Gp2yGXspablToKv9yNX9R0q7uHG7j3ybKn5yTBkuf7RmjE0bpd-hZal3QG6OLF_SBHlBElwsRXgNO5fQXIJhmDFWs-qxNPubfucaEDGbhItILQsAL2FBqv33U3HpKDfXG6knD4ok_QrQ0VftJ7lmBOO-M2-dsfjULkzczBBx3DtM/s624/No%20file%20reputation%20as%20per%20hash%20search%20on%20virus%20total.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5PTgt4lvWMZmsVOSilwDkyX2GYf34nsGXNKm2eiQS7c-UZqv9xLbeSqOfFz2HzBbtvDsaA96lKNDfhRl10X3O172bI1ZQ9Nygxu1l_Z0c5bEaFe2g1gQhe2TP0G1cRGCeXnDvkkJ8P8BFzWKqN-SCizJ4Inogi2WodHMpuMlpMOXMz141MCW2l6hmA9c/s1216/Figure%20showing%20difference%20between%20local%20and%20system%20time.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjus8emojQZGC5aAaExJkPEu9aJBoQEjFEnWTAKYAWc-RmG7ENpnaSeFkbozglYMjNxT366cZPusqTFe0nKr9IbL4DFr3u0RHecYXlynlCTK5MblI64g38JrSSOD9kS-3c34ipU2mcnj7r3LWEbFOQjpFggaET4KyV214FWBj22yK2sYCEcXZ1mwwrPlEE/s1219/Time%20zone%20bias%20information.png

blogger.googleusercontent.com

https://www.linkedin.com/posts/morad-rawashdeh_digitalforensics-cybersecurity-incidentresponse-activity-7319617406379646976-g5et/

linkedin.com

https://www.sophos.com/en-us/blog/remote-desktop-protocol-how-to-use-time-zone-bias

sophos.com

https://4n6post.com/artifacts/timezoneinformation/

4n6post.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyJ6MyhD-cRPTEbWwhJcyfREtOvg6g-LvvvX3Igkp32GkcQEvdjlT5-o6P6eVl3mjmKjBu0LkX-TyBUDH4_9WMsD6PBxr__CCqKpF4CoVmJRgRiwn-U7urzjiVoKtJgNK6fN0agUPWo3bUZmFeFCDCytwTMb0fHquaR2jAqacTtAe6F7BPmIJapA-53Zs/s897/AdobeFlashUpdate.exe%20establishing%20a%20network%20connection,%20which%20was%20followed%20by%20execution%20of%20whoami.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3MyJfYgsTpTP1KzL1cyQuga3QwLqdgQYhUqAPVh1bYuBBloLR4aq6anhIwKzrj0EeJPG9-egltys0woob1fVBCohcKw3k5kIPzjGQcBSAi5JNdSR2L2Oi-Gqpd8vxK6coPxSJDpV54VaEDdrWlRYenJ4mx5d_3Z2o_OKkqrizjY-Pc_LQpom7htxU2uk/s1218/figure_4_malicious_file_detected_by_threat_intel_feeds.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJktekDNFhMDjvbZyXh2GlJLdtUpYglW9dfveg2o31PkyKgYji4lcigJ4LY3djqOZYvL9veDG7Rq6oJ0vEg8PzHLjqkGUmupk59J8TFXqnW8JGZTHjtcK1nvIiSEDRUGeBrx7Fz3Gm_ttWirkyX_Jmdncj7yaiDhiki6ZzFJu18DrDjPh5LEg4wCljZ0/s1198/figure_5_executable_written_by_lsass_to_system_directory.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3yGRiTHFLW2SaH9AyFP9qciylkOOnwcgqbD53Y9IoSW7hE60MRZNmaZzd1qLJUs-DBng6yk4mN6QUjSmJ5ftEA_A5BMyU93_KVp4SF-MRAjAalAWfXsFZg1Ex7F6lA9MmzGV1NRYmQEZYvAmSSEZWNTdtffKfjNSdhgDYde-MMUYTKt9QKHm91Ffn0SI/s1657/Process%20execution%20chain%20by%20lsass.exe.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPq54S3X4YeF8q-DYMDbNJfSyzy7RCp-MW952xzsP6Y0pjNE7E8Fqx_SUS7b-9Oj19xLwp-tSt294psFiwxQJp2rXeUceWGJJA0zOt_eHEwt-XpPB9GCjCPf3iIMg9dfdZgImD38cOCW9-0JZ691jHQ77Ltca4U9pBhpO7u4pkukOlfqCHhh6Sdq6onnk/s1065/figure_7_suspicious_executable_adobeudpate_exe.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVRCGHIeAiI0kM6BVyGUl-rSlEia1xmT8ZJCn5lja29WyzM8eo8TA-VpSv_Yti5-zc4EL_0-ZFcc77SwH7-4TJu_7FaI4Qaer5y-chnI6s4IFE_SetkqPSUFF-JrFBrpIEp5K_bWrxzUL-vrTkVMsla0QykPpXqzNlOYjlPCRVoDCPrnejsUeicbbGjgU/s1038/figure_8_adobeUdpate_triggered_execution_of_werFaultSecure_exe.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj94OdFjgV6-Y_qI1ganu3MF284vbNi9LB0U48cYA05ckCeJe_FXki7cYL5Y4JWXSxBJDc-5LOW_PolYxJOJl7swBPIxNMfw8c72BbVaVw6kRfKQhQkhAogWyWlg0c3IzGhMSrWjB-WnewAOEGjioxmDrVzvYUK-hRhGvy9p_fD6QGkW37CZ0g6JMU-fJ4/s1044/figure_8-1_Evidence_of_pid_3280.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgpxD7-jgzgcFE1lxxLf4ulvph9t0VmLGf4SHEfPyYJ-vRHlzRNpt7EPQVjHPQjCA-Gv1ZbGItvUtJsx4UqdFX9MNsN7eEaus20iY_rCtu1i41JkCUCr_S8QYR1pajLILbtySdPM4QJpXUOIZaOYNPzhX6NzmnbZWmcSfk4ACtolYwvBp09TrNWWCNsLso/s979/figure_9_SID_for_newly_created_user.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDsHuZEmEkLJ9JrIYzLVBbBwqtnM1pLAR3zzvI3ehyJCGvqeUson-WQFY5ny0-k81yJv_4TcMxz9xFF6X4QEHwKsFobBO1RGJb-KHRwwjZ0_3i143JeSKvG_kwUEhbYjgwD6MY1rBhQ3zx2yu-lHpRd4ynWcmmAl9vttVVHjozXwfQ9Dc1Z826xmj3RjI/s1018/figure_10_user_added_to_administrator_group.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhA2zros_W0aZKGiuZjQLuM2MEXX-hF7P7DxMuEJ4LDBv0HDKzz2no5l3Rca_AtBlb6SroekoLM-ncks62Kjs5RzUW_HIFftXet8v31eoQp2m8PnnEeoJgoRG7XTrq9vJUw4pacdaUX-4O86JeWWcVglf4UI5JLVYc6LHq_DOQ4FohlSDyhrRCKbIIVqo8/s1014/figure_11_Powershell_logs_showing_firewall_rules_addition.png

blogger.googleusercontent.com

https://cyberchef.org/

cyberchef.org

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhenwUsh9d8IQ_7dpACjUitSN_YQNGmeQsLfhQfkpgA42DfQ_kX4uKyTz85INsvL32wA-m3WanKhRZaBGlMFSs_3awLFQYx2u8kNw5dg0Eb6J3DEZy98PklEODTlrrmBSiw9JMwF3hL1GcbkDlaMgD5KnszvyARp2D7qHUjsp-uFIKo9DbAazNWC9pm7nk/s1351/Attacker%20attempted%20to%20drop%20a%20fileless%20malware,%20or%20establish%20persistence%20using%20WMI%20event%20subscription.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjanTr00FMosGP5bAVRFWnumrXoTtD86s2nnPYAFzERcj8_mqrG1Z4EaHUSOUO3_d2FjmTHN1DpkU0A5rgQaNTd5SqKrxTCyW9tt_p933VPgnOSdoyg9n-FELL59GwXTc3Rq7eehb0HnDrC7tfKsu4kdI531lyWpjq9YDHE961XNb_KiG63_Wwtetysf5U/s1153/figure_13_system_reboot_observed.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyamdMdNIdzfz8YcjJUbUyNaTD7AzW-tipV0WSvdTRByGE50yw129I9PmTR9Vv3FWJSpKqe99fv3zPj-y-A9oc0dMX87ftyYd96LtUgNlO-Afn0qqHQt-WsZpeHvAvC8D8x6esi2LIe67prfI0qnCXtu1-h0NHze-2JZYBrJByoWjWAdMJYXMUmy0KHzA/s1024/figure_14_cortex_XDR_health_service_started.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgR6YmamFQXQm4V2tQUDPbgxlANAuz9DKnzmgq5_EDvCLZof5X5OsCMHBR3T3AM2Xj8NjZOYAk6pXkEwzwI8c4D3c-bG65E9n2KcqW5VguhrzXYy0q1ezmt9ht3XGs8J-RV7hwObJ5ABZpJbJj7c3viL7Dp6ufDba1ulh_8pTsL0kIU-No0xLdqiKPoUoc/s1237/Provided%20artifact%20is%20an%20executable.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRMKoGc72SIVnnOvm2nr71RMSdB8DCvVjrp6a5YHSBMCXMv6rotBHPFEyfELZ0KJmeSA23t_db9e00itpF86TN3Mw870G6H4eJz65CnRoUNb10PWWUah69YR-i6PNefG5MMgseAK4_d4l4XnLsPR3CeN50Qw8J1nJjenUGUU67V58jD4T-B5DwpmhblYA/s1086/figure_16_deleted_executable_has_same_hash_as_AdobUdpate_exe.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg9si8Z02TcOx4TSnZnGfToThZyzsk4z8-7DZle-rPtLr8sIDoPoPLIYL0OGjdjFnQcJ6YDu7ZUa3MQuLHogh912N558jREszZvQGWQmTSlfWUoGV2Bj5cZ_e81GlCzn0we67wgkYxqDv9GVFeYnDn2veVW-jPDIfeLApLPPvUglsf0cdRFrlHIHIMGcmc/s1360/Performing%20static%20analysis%20using%20strings%20revealed%20its%20nature.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHVIJBrPLQDZVQzUG3zdOcawxZnOZ8cAp3ZFxLSvrfj8R9a1Vz9OGy5L_j9Cz-qMFK1VGVPGYKG8E4KQFZ-JOtmhnYhHDoukOK7yM8JpqderEUtz6N_RW8gHwADgL7APCoJyGPrmYnwsZ_W134RJr1SFqGTxDHMEAJHu95bTTZV-i_B-eVNnvaDLBFNuY/s645/figure_18_executable_metadata_revealed_its_name.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFSExCSpHbJ-72KoIZeuTfhs3CZr4noase1j_sgSaAg2U2e3qObymghjLW47ptBECxURVcr8gefBhocTiU2gW_VajJPhTrOVJS9kZ_hGCMRGxqVm_aFuH98xVXElxW5oFjujhOrr6y43Zs168x5RVld594Xu2S9ljABtp0_c2Alvxd248sp1a24dae1jQ/s1095/figure_19_probably_executable_path_in_developer_environment.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjipF_7xbwu2M3-h5G0zoFAcE1jB4HpY-qPG7fjG-WLSis8DWTN81ls_19GRdOo__9aMYl7BC7JjSIrBHlObQlYAKRHJK_wvemeQHh295c1y66D29RPDAk62YlcPeIVvt_KUyYt_lQbTx3Psurkweat3LkFOUlMqyQJw9LuH6m4Xq35DtGHz6z3RCZgMHU/s1174/figure_20_Volatility_plugins_output_saved.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEge1M4EznwmNjIlj4fRqN1q-sNNwO-f7G9tP8LY9nmdcbYEH62aRsz8K_0tAum_QXyCU14V-984VcKV5ssB4BzANofRi3Pg_naCOk-fnM02X-IkrB_fTsFd4V1DLmTvxjoZU6S_ND_49_gS5HVtxN4TxDofGmzfDcCc2iB7UCOrO9QdSE1ULlNfHLI6bTw/s1360/SSH%20connection%20towards%20attacker%20IP%20post-reboot.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhy57WRITnQnKny40hM2qS0alpqrHqnk_Wb4VME3k12TWxI7A-bN71GCm0PerwBd-nnhggU3EyMgUafaW7Yu9FdXtiWLNqRYCnkk1VP3eTWYaHiGqqjbvmWoWxPd9sSacu8z8Z5nxWTbU8hPk2ASrDo91Y128SVMOptc-Ga2AFOe7vCR_JkQLw3VrUg9vA/s1363/SSH%20process%20originally%20started%20.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh46O-U_aTm5A-G5GPrsPWMkLKNcj1lquor9JDB38UEAxiNI_m10ubAFNEUU7CqNhSkEn2fWQ5zz0mz2A7M1fbSjSVpIdfYpV-SUPkwRmVQR2v7LDDJsbvKd5iO_qP84ati4TNQzntF_4IAzicnsvtvSqGqvWmBjodhZYfZ81OdrSX7JgRm6UEIm9uNrpU/s1333/SSH%20process%20tree%20(1

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpnD536mLeviu1AE7tPpDFlfJTGyu7LE-YMu9zLoh8v7FwP37QiMQzt6gFhIoaoovGcs4mto8PwgLsqlK7qGnDWUj7UIH4OB-sx852qgTRNPwYN2TzoU1JVCCIB1djwl-ztdqrlxEnLfWBikxXiL8QOnFYZNNLTIzVJV4Y1a4hUrwKFhYXyVEs-TTG6gs/s1026/figure_24_using_volatility_to_confirm_ssh.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfzze9yRwBg2_M5PrINPhG5AF145RX34BDGdd1j9nQyJaToFb_zwyMu4CGRplvd04XJjcnfO96ttpu8HVMG4nd0d6fMoBiaGyTWSGgVDzE4DciSdAwTs6O9FRuCzeqEf97N7xcr3p1edIVASzSJrrnstWj7Rmfx64nGBaQiCNCEPEMErswKShMF-UzQXo/s1362/Provided%20artifact%20was%20found%20under%20user%20Vic%20Recycle%20Bin.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEdDhyphenhyphen1e58-rA8NKsT7zJQ9mKCWCBC7qztQ3YcmyVAxWgAlzOGzQlW3ozcnFnq5J5KblrQKOaxlE5kVdgFvD8WnaUGc4SSVmeX7rYXaylhMTEnFo-wJBQvarfufK8-Y9X4_FCO4Ge3VSJh5oO_07oMr1kdXa5ZhoLASzH_sqpMKNlikOWxLy6YNo1Y8Ec/s1339/File%20deletion%20timestamp.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgfEONhnsLtBaA8ijqa9WBhVtuy-o3nm_lEFL5-KiRLML6o8yPvJtPwOwo_zTf3vYci74bS_ZMhBuKR3hm7lQhcLJTOZ-_U9AtqXFOSbgwPt8kU7BpBHG5CXw2qQGpzWDbYo1HxUnTU27A3taTvYx121w1miFI9ZocG7womsQcAEELavSabsyw_17oADn0/s1359/Attacker%20relaunching%20AdobeFlashUpdate.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivX-jjJMykLdaVmPcwYMV39yC2dJYK4YrVVkg7wmoflxlThFHw_MSQdIiLqA0ebPsayxDplJ5lGEOL8RHip1DhzChSN-CJTK4u-GTur2ka4p-ptR8K8rC-p0nFrp04oVfqxNJCNfkDBox-soaXjld2C8vZvQjWzJxgj6MGlA2Ut2qx7LFp60g1Qzat22s/s898/figure_28_ssh_connections_seen_post_reboot.png

blogger.googleusercontent.com

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjLJIEylJ3mipMpBOhg2-gzfQAYypJ2u0PsVGLEK2Gm-LHVMq5UCJJndPubadcaerwCt8vm6Zvzw-lnt5Le_E13ayNVp4luc9aKJKvT3yOxu-xWLatGbgK2HPmHkrARaCmig4mPaejCMI8dM5Qjmk4Izr8VQCWmyciMaaRWUuSlD3uoA87lqfuqh8wFcc8/s798/figure_29_security_log_confirming_logon.png

blogger.googleusercontent.com

https://github.com/r00t36/CTF-Silence-of-the-RAM

github.com