Reference no: EM132463217

CTEC5807 Malware Analysis - De Montfort University

Malware Investigation

LO1 - Identify and analyze malware using appropriate procedures, tools and techniques.

LO2 - Interpret and communicate the significance of malware behavior to decision makers.

LO3 - Distinguish and critically compare malware delivery and spreading techniques.

LO4 - Assess and synthesize the likely impact of a malware infection from its binary.

Assessment Tasks - In this assessment, you are expected to:

Analyze two specimens of malware and write a report answering set of questions about the insights gained and detailing your approach with relevant evidence (e.g. screenshots, excerpts of logs, etc.)

Part 1: Basic malware analysis

Scenario and goal - In this scenario, an acquaintance was e-mailed a suspicious attachment and wants to know if it is malicious. He already opened the file and was surprised to see a foreign-language sentence. Now he is concerned that he is infected with malware. Answer all the questions below and write a full report.

Analysis tasks -

Task 1. Analyze the social engineering component of the malware. Translate it. How does it try to get people to execute it?

Task 2. Your friend has already opened the document attachment. What happened? Is his machine already infected? Find proof for/Argue your answer!

Task 3. Extract the core malware and document the steps.

Task 4. Perform a basic static analysis of the sample and document your findings. Is it packed? What do the imports and exports tell you? Do you see anything suspicious Part- wise? Interesting strings? Remember: MSDN is your friend!

Task 5. Analyze the sample dynamically and monitor the activity on the system. What changes? Is anything dropped, executed or deleted? If you use Regshot, be careful to set the right scan directory (C:)!

Task 6. Can you find indicators for sandbox or VM detection? What can you do to circumvent it? Restart your analysis after taking care of the anti-analysis technique(s).

Task 7. Try to find out what the sample is about to do network-wise and set up an appropriate fake environment. What is happening?

Task 8. What are the sample's runtime dependencies? What is it trying to download? Try to play along and set up the environment it wants and determine what the malware needs the additional software for.

Task 9. Extract and document all relevant IP addresses that are or might be contacted (static and dynamic analysis) and determine domain ownership.

Task 10. If you satisfied all the sample's requirements (i.e. installed all the components it needs) the malware will alter your system's configuration. What is happening? Hint: Certificates.

Part 2: Ransomware disassembly

Scenario and goal - In this scenario, your company's CFO was victim of a crypto locker, losing all her precious holiday photos. She comes to you in hopes that you'll be able to help her recover her files without paying the ransom. The incident response team has already located the malicious sample and provides you with both the malware and an encrypted sample that needs to be recovered at all costs. Answer all the questions below and write a full report.

Analysis tasks -

Task 1. Perform a basic static analysis of the sample and document your findings. Is it packed? What do the imports and exports tell you? Do you see anything suspicious Part- wise? Interesting strings?

Task 2. Attempt to execute the sample and use basic dynamic analysis tools to determine whether the sample causes damage to the system. Can the sample be executed as is? If yes, what happens? If no, why not?

Task 3. Load the sample into IDA and attempt to locate the "main" function (which is not necessarily called this way). You will see a lot of exit conditions that will terminate the program when run. Where is the main function? Highlight it and expand it.

Task 4. Document and interpret what's going on in the sample's main method. It helps to rename functions whose purpose you have identified. Which function calls can you identify and name? Hint: Pseudocode might help (there is an IDA plugin for that!). You might also want to return to/continue this part of the exercise later during task 9.

Task 5. What parameters does the sample need to function? What are their types (integer, string, etc.)? Combine fuzzing with disassembly (i.e. supply likely parameters and see what happens and also locate the spot in the code where the parameters are defined).

Task 6. Armed with the correct parameters, use the crypto locker on some files of your choice and document what's happening (return to dynamic analysis). How is the malware altering the test files (use hex editor)?

Task 7. It can be assumed that the ransomware first reads the file, change its contents, and then writes the new version to a file. One possible analysis approach can be to "follow" the source (victim) file through the encryption process. A combined approach is most promising: Use Procmon to monitor file accesses while running a debugger to locate the corresponding functionality in the code. Where are the read/write operations located in the code?

Task 8. It is time to determine the kind of encryption that is being used by the sample. Download and use the tool "signsrch" to get an idea of what is happening. Which crypto algorithm does the malware utilize?

Task 9. What is the key for the encryption process? Where does the crypto locker get it from? How is it processed within the malware and where does it end up?

Task 10. Now that you know what kind of encryption is being used on the files, use a tool of your choice (e.g. online tools, GitHub apps, self- coded approach) to decrypt the CFO's file. Document the steps and the final (decrypted) result! If you fail to decrypt the desired file, document the process with a file of your choice (where you know the key) for half the points of this item.

Note - Written report with consecutively numbered answers for each task (max. 6000 words).

Attachment:- Malware Investigation.rar