Reference no: EM132597909 , Length: word count:5000

CTEC5807 Malware Analysis - De Montfort University

Assignment - Malware Investigation

Learning outcome 1. Identify and analyze malware using appropriate procedures, tools and techniques
Learning outcome 2. Interpret and communicate the significance of malware behavior to decision makers
Learning outcome 3. Distinguish and critically compare malware delivery and spreading techniques
Learning outcome 4. Assess and synthesize the likely impact of a malware infection from its binary

In this coursework, you are expected to:

Analyze two specimens of malware and write a report answering set of questions about the insights gained and detailing your approach with relevant evidence (e.g. screenshots, excerpts of logs, etc.)

Part 1: Basic malware analysis

Scenario and goal

This is part 1 of the graded exercise. It is worth 50% of your total grade. Every question is worth 5 points, for an exercise total of 50.
In this scenario, an acquaintance was e-mailed a suspicious attachment and wants to know if it is malicious. He already opened the file and was surprised to see a foreign-language sentence. Now he is concerned that he is infected with malware.
Answer all the questions below and write a full report. If you want to work in pairs, identify both authors on the report cover sheet and upload it twice.

Environment & tools

Statically and dynamically analyze the unzipped sample "29-10-2014_Quittung.rtf" on a Windows XP SP3 virtual machine. The archive password is "infected". Please note that this is real malware.

Which tools to use is completely up to you. In malware analysis, there is rarely only one "right" path. Be creative! Still, I suggest you look at previous exercises and pick whatever tools you deem appropriate.

For this exercise, it okay to let the sample talk to the outside world. Before you do that, however, it is recommended to simulate internet communication (also see lab exercise "Combined dynamic analysis") and determine beforehand if it is safe.

Analysis tasks

1. Analyze the social engineering component of the malware. Translate it. How does it try to get people to execute it?

2. Your friend has already opened the document attachment. What happened? Is his machine already infected? Find proof for/Argue your answer!

3. Extract the core malware and document the steps.

4. Perform a basic static analysis of the sample and document your findings. Is it packed? What do the imports and exports tell you? Do you see anything suspicious section- wise? Interesting strings? Remember: MSDN is your friend!

5. Analyze the sample dynamically and monitor the activity on the system. What changes? Is anything dropped, executed or deleted? If you use Regshot, be careful to set the right scan directory (C:)!

6. Can you find indicators for sandbox or VM detection? What can you do to circumvent it? Restart your analysis after taking care of the anti-analysis technique(s).

7. Try to find out what the sample is about to do network-wise and set up an appropriate fake environment. What is happening?

8. What are the sample's runtime dependencies? What is it trying to download? Try to play along and set up the environment it wants and determine what the malware needs the additional software for.

9. Extract and document all relevant IP addresses that are or might be contacted (static and dynamic analysis) and determine domain ownership.

10. If you satisfied all the sample's requirements (i.e. installed all the components it needs) the malware will alter your system's configuration. What is happening? Hint: Certificates.

Part 2: Ransomware disassembly

Scenario and goal
This is part 2 of the graded exercise. It is worth 50% of your total grade. Every question is worth 5 points, for an exercise total of 50.
In this scenario, your company's CFO was victim of a crypto locker, losing all her precious holiday photos. She comes to you in hopes that you'll be able to help her recover her files without paying the ransom. The incident response team has already located the malicious sample and provides you with both the malware and an encrypted sample that needs to be recovered at all costs.
Answer all the questions below and write a full report. If you want to work in pairs, identify both authors on the report cover sheet and upload it twice.

Environment & tools
Analyze the sample "cryptolock.exe" on a Windows virtual machine. The archive password is "infected".
Which tools to use is completely up to you. In malware analysis, there is rarely only one "right" path. Be creative and know when to stop. With disassembly, you will see many functions that will not yield any useful answers.
For this exercise, it okay to let the sample talk to the outside world. Before you do that, however, it is recommended to simulate internet communication (also see lab exercise "Combined dynamic analysis") and determine beforehand if it is safe.
The questions below provide hints about the technical backgrounds and recommended MO.

Analysis tasks

1. Perform a basic static analysis of the sample and document your findings. Is it packed? What do the imports and exports tell you? Do you see anything suspicious section- wise? Interesting strings?

2. Attempt to execute the sample and use basic dynamic analysis tools to determine whether the sample causes damage to the system. Can the sample be executed as is? If yes, what happens? If no, why not?

3. Load the sample into IDA and attempt to locate the "main" function (which is not necessarily called this way). You will see a lot of exit conditions that will terminate the program when run. Where is the main function? Highlight it and expand it.

4. Document and interpret what's going on in the sample's main method. It helps to rename functions whose purpose you have identified. Which function calls can you identify and name? Hint: Pseudocode might help (there is an IDA plugin for that!). You might also want to return to/continue this part of the exercise later during task 9.

5. What parameters does the sample need to function? What are their types (integer, string, etc.)? Combine fuzzing with disassembly (i.e. supply likely parameters and see what happens and also locate the spot in the code where the parameters are defined).

6. Armed with the correct parameters, use the crypto locker on some files of your choice and document what's happening (return to dynamic analysis). How is the malware altering the test files (use hex editor)?

7. It can be assumed that the ransomware first reads the file, change its contents, and then writes the new version to a file. One possible analysis approach can be to "follow" the source (victim) file through the encryption process. A combined approach is most promising: Use Procmon to monitor file accesses while running a debugger to locate the corresponding functionality in the code. Where are the read/write operations located in the code?

8. It is time to determine the kind of encryption that is being used by the sample. Download and use the tool "signsrch" to get an idea of what is happening. Which crypto algorithm does the malware utilize?

9. What is the key for the encryption process? Where does the crypto locker get it from? How is it processed within the malware and where does it end up?

10. Now that you know what kind of encryption is being used on the files, use a tool of your choice (e.g. online tools, GitHub apps, self- coded approach) to decrypt the CFO's file. Document the steps and the final (decrypted) result!

If you fail to decrypt the desired file, document the process with a file of your choice (where you know the key) for half the points of this item.