Tasks to be undertaken:
In this coursework, you are expected to:
Analyse two specimens of malware and answer questions about the insights gained, detailing your approach with relevant evidence (e.g. screenshots, excerpts of logs, etc.)
Part 1: Static and dynamic analysis of an unknown suspicious file
This is the first part of your graded coursework and is worth 50% of your total marks.
Scenario and goal
You have been provided with an unknown file found on a suspected infected machine on your organization’s network. The goal is to perform an in-depth analysis of the file to determine its type, infection mechanisms, and document any observable behaviours. After the analysis you will recommend steps to eradicate the malware from all the other systems in your organization that have been infected by the same malware.
Answer all the questions below (in the analysis tasks section) backing your answers with appropriate proofs and detailed supporting documentation and evidence from analyses. Please provide your answers under each given question. Any references cited should be listed at the end of your report.
Environment and tools
Analyse the file “suspicious.file” on a Windows virtual machine. The file should be extracted from “suspicious.7z” with the archive password ‘infected’. Please note that this is real malware. Which tools you use is entirely up to you. In malware analysis there is rarely one “right” path. Be creative and observant! However, I suggest you look at previous lab exercises and lecture slides, and pick whatever tools you deem appropriate. Provide documentary evidence to support your answers where
appropriate, for example screenshots, excerpts from Logs, dumps and other analyses outputs.
Analysis tasks
1. What type of file is the suspicious program? How do you determine its type? Document the method you used or steps you took to identify the type of file. Can the program be run as it is? If not, explain what would you do to make it execute? [5 marks]
2. Now that you’ve determined how to make it execute for analysis, is the malware packed? What observable features of the file suggest that it may/may not be packed? Document your observations with any applicable tools of your choice. [5 marks]
3. Next, perform a basic static analysis of the malware sample and document your findings. For example, what do the imports and exports tell you about the sample? (Remember, MSDN is your friend) Are there any interesting strings? Can you observe anything suspicious section-wise? If the sample is packed, make sure you unpack it first. [6 marks]
4. Analyse the sample dynamically and monitor its activities on the system. What changes do you observe on the host? For example, is anything dropped, executed or deleted? (Hint: if you use Regshot in any phase of your analysis, be careful to set the right scan directory i.e. ‘C:\’) Support your claims with documentary evidence. [8 marks]
5. Is the malware sample persistent? If yes, how does it achieve its goal of being persistent on the system? What corroborating observations can you put forth from your analysis that the malware is persistent? Provide evidence of the sample’s persistence on the system (use appropriate tools to investigate). [6 marks]
6. Does the malware exhibit any network based behaviours? Analyse and document any observable network activity under (a) an isolated environment and (b) with the system connected online (in this exercise it is ok to let the sample talk to the outside world). Document all observable traffic/network activity patterns using appropriate tools and techniques. [10 marks]
7. As a member of the incident response team in your organization you are tasked with the removal of the malware from all systems infected with this same malware. How would you eliminate the malware from an infected system on your network? Outline the steps to be taken in cleaning up the system. Show how you would confirm that the malware has been completely removed by the steps you have taken. (Hint: For example you can use RegShot before and after the clean-up to show that the infection has been removed) [5 marks] Presentation: organization, readability, references etc. [5 marks]
Part 2: Analysis and reverse engineering of a malicious DLL This is the second part of your graded coursework and is worth 50% of your total marks.
Scenario and goal Your friend received an email with an attachment and proceeded to open the email. Without being careful, your friend opened the attachment and is now concerned that the system may be infected. Answer all the questions below (in the analysis tasks section) backing your answers with appropriate proofs and detailed supporting documentation and evidence from analyses.
Environment and tools Analyze the file “malsample.dll” on a Windows virtual machine. Extract it from “malsample.7z” with the archive password ‘infected’. Which tools you use is entirely up to you. In malware analysis there is rarely one “right” path. Be creative and observant! However, I suggest you look at previous lab exercises and lecture slides, and pick whatever tools you deem appropriate. Provide documentary evidence to support your answers where appropriate, for example screenshots, excerpts from Logs, dumps and other analyses outputs. Please provide your answers under each given question. Any references cited should be listed at the end of your report. Analysis tasks 1.
Your friend receives the file in an email attachment on their windows XP machine and accidentally double clicks the file. Is their system infected?
If yes why/how? If no, why not? Explain and support your answer with evidence from dynamic analysis.
[3 marks]
2. Analyse the sample dynamically and monitor its activities on the system. Outline the steps taken to execute the sample for analysis. What changes do you observe on the host? For example, is anything dropped, executed or deleted? Any other changes to the host observed? (Hint: if you use Regshot in any phase of your analysis, be careful to set the right scan directory i.e. C:\). Support your claims with documentary evidence. [8 marks]
3. Under which process is the malicious DLL running? What is the process ID of this process? Document your approach and show how you obtained this information. [5 marks
] 4. Does the malware exhibit any network-based behaviours? Analyse and document any observable network activity in an isolated environment. How does this malware behave networkwise? [5 marks]
5. Reverse engineer the sample with IDA/IDA pro. (a) How many functions are exported by the DLL? (b) What are the addresses of the functions that the DLL exports? (c) How many functions call the kernel32 API LoadLibrary function? (d) How many times is the kernel32 API Sleep() function called in the DLL? (support your answers with documentary evidence e.g. screenshots) [4 marks
6. Navigate to the ServiceMain function. (a) Show the graph view of the function (b) The main subroutine (of the ServiceMain function) jumps to a location where the code calls the kernel32 API Sleep() function right after the JZ assembly instruction. What is the value of the parameter used by this Sleep() function? [5 marks]
7. Malware analysts sometimes need to patch an executable in order to alter its behaviour, especially when the malware uses evasive techniques. The parameter used in the Sleep function (referred to in question 6) provides a time delay after which the main sub-routines are called to perform network operations that generate traffic. Permanently patch the DLL to remove the delay so that the network activity begins without any delay i.e. immediately after the DLL is executed. Document the steps taken. [10 marks] 8. Run the DLL again and confirm that your patch has removed the delay. Document the activity and present the evidence showing that the delay in sending network traffic has been removed. [5 marks]
Presentation: organization, readability, references etc. [5 marks] Deliverables to be essay prosubmitted for assessment: Written document consisting of two parts, with answers to each question provided as a separate items. Detailed answers and documentary evidence should be given under each question. Where appropriate, references should be listed at the end of the report and cited within the body of the report (max. 3000 words excluding figures, references, appendices, etc.).
Part 1: Static and dynamic analysis of an unknown suspicious file; and Part 2: Analysis and reverse engineering of a malicious DLL need to be presented in the document. How the work will be marked: Each malware sample analysis will be awarded a total of 50 points. The questions each are scored from 0 to a maximum point indicated alongside each question, following a specific marking grid that considers the substance of each written response. There is a total of 10 marks for presentation quality (5 marks for each section). Please refer to the criteria marking grid for details of the assessment of the work.
