The executable to be used for this assignment are live malware and need to be handled safely. Please do not download and execute files on your host machine. Download and execute the files in a Windows Virtual Machine (VM) and isolate the environment by setting the network adapter to host only as described in the Lab
setup document. Revert to a clean snapshot after each execution.:
This assignment has three parts.
(Do not download and execute the ransomware file on your host machine.)
Task 1: The ransomware runs a Domain Generation Algorithm to generate multiple domain names that it then tries to resolve through DNS queries. Once it finds a registered domain, it communicates with this domain as its Command-and-control server. In this task you need to get a
Task4: In this task, you will write YARA rules for the ransomware variant by creating your comments, strings and defining your conditions. Give your rule a name and add some metadata.
Your rule must make use of the hash and the PE modules. Your rule must have at least two strings. In addition to the two strings, it must have at least one function from the hash moΒ dule and at least
two functions from the PE module. Include the YARA rule in your report and provide it as a .yara
(Do not download and execute the putty.7z file on your host machine.)
The SOC team has found a well-known application putty.exe on a computer in an unusual location. In this part of the assignment, you must investigate the file following the steps below and complete the tasks.
Step 1: Download putty.7z from moodle in an isolated environment on a Windows VM and extract the executable (password:infected). Putty is a well -known open source SSH and telnet client for
Windows. If you have not used putty before, familiarise yourself with putty and its capabilities.
Step 2: Execute the file and observe the behaviour before the appearance of standard putty interface.
In this part of the assignment, you will reverse engineer the assembly code provided in the assemcode.txt file.
Remember that anything that starts with keyword LAB is a label. The start of each function is marked so you can easily locate the functions. The program starts from main(). The comments also show the local variables that are allocated space on the stack for that function. These are not part of the code but have been provided for your reference. The variables have been given arbitrary names for easy decompilation and ease of reading. You will find that there are calls to the printf function in the code, but the code does not have the subroutine for printf. You can assume that a call to the printf function will result in printing the value at the address stored in
the RDI register.
Assignment submission
Submit everything in a single (pdf) report on moodle. You must also submit .yara file you have created.
Extensions
