OpenCyber Academy
Technical · Chapter 17 · English
Course code: OCA-063Chapter 17: OCA-063-C017

Chapter 17 — Digital forensics and malware analysis: Contained laboratory II

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 17 published. Map, example, EX065.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Process trees"]
  N2["17.2 The lab data"]
  N3["Lab — building the tree"]
  N4["17.3 Reading the result"]
  N5["17.4 What cmd did"]
  N6["17.5 Relating to the timeline"]
  N7["17.7 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX065"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Process trees"]
  N2["17.2 The lab data"]
  N3["Lab — building the tree"]
  N4["17.3 Reading the result"]
  N5["17.4 What cmd did"]
  N6["17.5 Relating to the timeline"]
  N7["17.7 Reporting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX065"]

[Learning outcomes]
    |
    v
[17.1 Process trees]
    |
    v
[17.2 The lab data]
    |
    v
[Lab — building the tree]
    |
    v
[17.3 Reading the result]
    |
    v
[17.4 What cmd did]
    |
    v
[17.5 Relating to the timeline]
    |
    v
[17.7 Reporting]
    |
    v
[Worked example] --> [Exercise EX065]

Learning outcomes

You will (1) reconstruct a process tree from synthetic EDR records; (2) identify suspicious parent-child relationships; (3) relate the tree to the timeline; (4) report findings with limits.

17.1 Process trees

Every process has a parent. Reading parent-child links shows how a program came to run: a document opened by a user, a script started by a shortcut, or a tool launched by malware. The SANS-style habit of "know normal" means knowing which children each parent usually has.

Knowing normal for ward PCs means explorer.exe usually starts programs such as Teams and the medication viewer, not script hosts running from a removable drive. A child process that is unusual for its parent is a lead, not a finding, until other evidence supports it. Sana checks each unusual link against the timeline and file events.

17.2 The lab data

The contained lab holds synthetic EDR process records for WARD4-PC2 around 10:02, using process IDs and parent IDs. No samples are present.

The records keep the real structure, a process ID, a parent ID and a name, but are synthetic copies prepared for the lab. Process IDs in the lab are simplified numbers rather than the values from the real export. The exercise teaches reading the structure without exposing any real hospital data. The lab copy covers only the minutes around 10:02 on WARD4-PC2.

Lab — building the tree

"""Build a process tree from synthetic (pid, ppid, name) records."""
procs = [(400, 1, "explorer.exe"), (812, 400, "wscript.exe"), (900, 812, "svch.exe"),
         (950, 900, "cmd.exe"), (420, 1, "teams.exe")]
kids = {}
for pid, ppid, name in procs: kids.setdefault(ppid, []).append((pid, name))
def show(p, depth=0):
    for pid, name in kids.get(p, []):
        print("  " * depth + f"{name} ({pid})"); show(pid, depth + 1)
show(1)

Run with python3 lab_tree.py. Verified output:

explorer.exe (400)
  wscript.exe (812)
    svch.exe (900)
      cmd.exe (950)
teams.exe (420)

17.3 Reading the result

Explorer (400) started wscript (812), which started svch (900), which started cmd (950). Explorer also started Teams (420), a normal child. A script host launched by explorer from a removable drive, then a program from C:/Users/Public, then a command shell, is a chain that does not occur in normal ward use.

The chain matches what the earlier filtering lab showed: wscript.exe started from the stick and wrote svch.exe. The tree adds that svch.exe itself started cmd.exe, which the event filter alone did not show. Teams is included to show that an unusual chain stands out against normal children of explorer.

17.4 What cmd did

The analyst's report says cmd ran system information commands; EDR blocked further activity at 10:09 containment. Sana does not repeat or test any commands; she records what the records show.

Sana's role is to record the chain and times; interpreting what the commands meant belongs to the analyst. Repeating the commands on a lab PC could add nothing safely and might confuse the records. Containment at 10:09 cut the PC off from the network about six minutes after cmd.exe started. Her diagram notes that cmd.exe's activity comes from the analyst's report, not from her own examination.

17.5 Relating to the timeline

The wscript start matches 10:02:41 corrected; svch at 10:02:44; cmd at 10:03:10. The tree and timeline agree.

The cmd.exe start at 10:03:10 comes twenty-six seconds after svch.exe was written, consistent with the program running a command soon after it started. All three of these are EDR times stamped by the synchronised EDR server, so they match the corrected PC-local times without any adjustment. Owen then confirms the cmd.exe time against the time given in the analyst's report. The agreement between tree and timeline supports both the clock correction and the order of events.

17.6 Limits

Short-lived processes can be missed if the agent was busy; parent IDs can be reused after a process ends. Sana checks start times to make sure the parent existed when the child started.

Checking start times means confirming that process 812 was already running when process 900 started, and so on down the chain. If a parent's start time came after its child's, the link would be a reused ID rather than a real parent. Sana records this parent-time check in the diagram's source line for each link.

17.7 Reporting

The tree goes into the report as a simple indented diagram with times and sources.

An indented diagram is easier for managers to read than a table of IDs, and the times and sources keep it checkable. The diagram cites the EDR export it was built from by its SHA-256 hash. Owen's confirmation of the cmd.exe time against the analyst's report is noted beneath it. The board version of the diagram omits process IDs and keeps the names and times.

Worked example

Sana's diagram: "explorer (400) → wscript (812) 10:02:41 → svch (900) 10:02:44 → cmd (950) 10:03:10; explorer → teams (420) normal. Source: EDR export, hash recorded. Parent start times checked." Owen confirms the cmd time against the analyst report.

Synthetic case. Records come from the lab script.

Errors and limits

Process trees show what started what, not why; intent comes from wider evidence.

Exercises

Synthesis

Process trees reveal suspicious chains; check IDs and times, and report with sources and limits.

Continue studying — chapter 17 of 18

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →

Worked answers

EX065. explorer (400) started wscript (812), which started svch (900), which started cmd (950).

EX066. Teams (420), launched by explorer as in everyday use.

EX067. She confirms that the parent process was already running when the child started.

EX068. Yes: wscript at 10:02:41, svch at 10:02:44 and cmd at 10:03:10 match the corrected timeline.