The security team has identified a suspicious process running on a Windows server. Your supervisor has sent you the following email about the situation:

Good morning,
The process in question is named amazon-ssm-agent. This server is not running in AWS nor has it ever, that's why this is suspicious. Please investigate the process and document the following information in a text file on the Desktop of the server named investigation.txt:

• Process name:
• PID:
• Username process is running as:
• Service name:
• Directory where service .exe file is located:

Once you've completed collecting this data, create a dump file of the process and leave it in its default location.

Thank you,
Billy Lumbergh

PS: I may need you to come in and work this weekend; I'll let you know.

Connecting to the lab:

1. Use RDP (Remote Desktop) to connect to the public IP address on port 3389 of the instance.
2. Log in with the username and password generated by the lab.

NOTE: Once the lab is ready, please wait 4 additional minutes before attempting to remote desktop to the Windows machine. Prior to that, the provided credentials will not work. This is because the Windows machine runs several preparation scripts once it starts.

For information on RDP clients, see:

For Windows: https://support.microsoft.com/en-us/help/4028379/windows-10-how-to-use-remote-desktop

For Mac: https://docs.microsoft.com/en-us/windows-server/remote/remote-desktop-services/clients/remote-desktop-mac

For Linux: https://remmina.org/