Volatility 3
Porting Thomas Chopitea’s Volatility ‘Autorun’ tool to Volatility.
The Volatility 2 "Autorun" plugin is one of the most popular third-party tools in the field of memory forensics.
The plugin was originally intended for use in an internal project. However, because that project required Volatility 3, it could not be completed due to the lack of backward compatibility with tools originally developed for Volatility 2. As Autorun is considered one of the flagship plugins for memory forensic analysis, it was decided to port it to the latest version of the framework.
The Volatility Framework is a collection of free and open-source tools developed in Python and originally released by Black Hat DC. It enables investigators to extract information from memory dumps generated by various operating systems, including Windows, macOS, and Linux. Originally developed in Python 2, the framework includes analysis modules known as plugins, which can perform tasks such as listing running processes, identifying recent network connections, and many other forensic analyses.
The framework also allows users to develop their own plugins, making it possible to extend its capabilities and address specific forensic requirements.
One of the main limitations of the Python 2 version (Volatility 2) is its reliance on profiles. For each memory dump, the investigator must specify the exact operating system version from which the dump was acquired, including the corresponding service pack. For Windows 10, it is even necessary to know the exact build number of the operating system.
Although the framework provides an imageinfo plugin that attempts to identify the appropriate profile automatically, the results are not always reliable. Another significant drawback of Volatility 2 is its performance. Depending on the analysis being performed, plugin execution may take anywhere from a few seconds to several minutes, or even several hours.
To address these limitations, the developers of the framework recently migrated the project to Python 3, resulting in Volatility 3. This new version introduces several major improvements, including the complete removal of the profile mechanism and a significant increase in plugin execution speed, among many other enhancements.
Autorun, developed by Thomas Chopitea (@Tomchop), is one of the most valuable third-party plugins available for memory forensic analysis. The plugin identifies and displays all applications and processes in memory that maintain persistence on the system, meaning they are capable of automatically restarting after a system reboot.
These persistence mechanisms can take several forms, including:
- Registry keys, such as those located under the Run and RunOnce registry entries.
- Windows services configured to start automatically.
- Application Compatibility (AppCompat) patches, which are intended to support applications designed for older versions of Windows. These compatibility patches may also be abused to load malicious DLLs.
- Application paths added to the Winlogon registry keys (such as Shell and Userinit), which control the Windows logon and logoff process.
- Scheduled tasks created within the Windows Task Scheduler, allowing programs or scripts to be executed automatically at predefined times or at specified intervals.
This port provides several key improvements:
- Compatibility with Volatility 3.
- A significant reduction in analysis time.
- Support for exporting results in multiple formats, including JSON, CSV, and others.
The plugin has been made available to the community through the Proximus NXT CSIRT GitHub repository:
https://github.com/Proximus-luxembourg-CSIRT/volatility3-autoruns
It was also announced via the team's X (formerly Twitter) account:
https://twitter.com/ProximusLuxCSIRT/status/1413416541887008773
By releasing this plugin as open source, we aim to facilitate the community's migration to Volatility 3, allowing investigators to benefit from the improvements introduced by the new framework. Publishing the project on the Proximus NXT CSIRT GitHub repository also enables the community to contribute enhancements, helping to further improve the plugin and make forensic analyses even more effective.