MISSION: Users report audio issues.
Investigate Workstations AND Servers. Search email clients on all hosts and report phishing attempts.
1. Identify: Check the Services Tab for stopped audio services or suspicious names.
2. Remediate: Use the Terminal to stop threats (`sc stop`, `taskkill`) and restart audio (`sc start`).
Drag Infected Assets Here
Complete the mission successfully to decrypt this data.
File Decrypted. Key Concepts for Exam Success.
Malware often hides in plain sight. In this Lab, the service was Wind0ws Audio Endpoint Builder (Zero vs O).
Block outbound C2 traffic (Port 4444) to neutralize the threat even if the host is compromised.
Servers should not have Email Clients. This reduces the attack surface.
Malware often enters via Phishing. Analyze these 3 key areas:
The Firewall Logs tell the story. Look for these patterns:
Every connection is defined by 5 points:
Src IP, Src Port, Dst IP, Dst Port, Protocol.
Ingress (Inbound): Attacks trying to get in.
Egress (Outbound): Infected hosts "phoning home" to a Command & Control (C2) server.
*In this lab, spotting Egress traffic on Port 4444 is your smoking gun.*
Common ports seen in exams and logs:
| PORT | SERVICE | RISK PROFILE |
|---|---|---|
| 21 | FTP | Cleartext creds (High Risk) |
| 22 | SSH | Secure remote access (Safe) |
| 53 | DNS | Check for tunneling/exfil |
| 445 | SMB | Lateral Movement Vector |
| 3389 | RDP | Brute-force target |
| 4444 | Metasploit | Default C2 / Listener |
Displays all running processes and their Process ID (PID).
/v (Verbose): Shows which user is running the process. Useful for finding malware running as "System" vs "User".
/svc: Shows which services are hosted in each svchost.exe. Critical for tracking malware hiding in generic processes.
Terminates a process.
/PID: Target by ID (safer than name).
/F (Force): The "Hammer". Forces the process to die. Essential for malware that refuses to close.
Displays active TCP connections and listening ports.
-a: All connections/listening ports.
-n: Numerical (IPs instead of DNS names - faster).
-o: Shows the PID. This is the "Golden Flag". It links the connection back to the specific malware process.
Tests reachability.
-t: Pings continuously until stopped (Ctrl+C). Useful for testing intermittent connections.
-a: Resolves IP to hostname (Reverse DNS).
Advanced command for communicating with Service Control Manager.
Unlike net start, this shows STOPPED services too. Essential for verifying if a security service was disabled.
config start= disabled: Prevents the service from restarting on reboot (Persistence removal).
Legacy commands. Simple but limited.
Only lists RUNNING services. If the malware stopped your Audio, you won't see "Windows Audio" in this list!