H9MWAN Malware Analysis Continuous Assessment CA1 Brief

H9MWAN CA BRIEF

This is a two-part CA.

Part 1: Set up a malware analysis lab (please note that you are not allowed to just download an existing sandbox, but you are expected to include a critical analysis discussing how looking at such sandboxes you leamed good practices on creating your lab).

Part 2: Carry out a research-based investigation into a piece of malware allocated to you by the lecturer. You will have to document the work carried out in the form of a report and include clear evidence (descriptions and screenshots).

Please look up the spreadsheet available on the Moodle page for this module for the malware allocated to you.

1. Malware Lab

1. Critical Analysis of Existing Sandboxes: A study of publicly available sandboxes-free/paid, downloadable/online, the tools installed, the good practices followed, etc.
2. VM Setup: Description and justifications of the VM setup (i.e., guest Windows OS version and configuration details, VM settings, etc.).
3. Software Tools: Description of the software tools installed and justifications of their selection (i.e., vis-à-vis alternative tools).
4. Lab Testing: Description and justification of the testing activities carried out to ensure that the lab is properly configured and isolated from the production environment (i.e., host, network).

2. Research-based Malware Analysis

1. Identification: Description of the malware sample, and any information available in the public domain or that can be obtained using an online tool: e.g., type of the file, its name, size, hashes, malware names (if known), current anti-virus detection capabilities, etc.
2. Analysis: detailed descriptions of the malware capabilities, behaviour, etc. This analysis should be conducted without downloading the malware using only online resources such as research papers (i.e., check Google Scholar), malware analysis reports previously done by companies/ bloggers, online tools and sandboxes (e.g., VirusTotal, Joe Sandbox), etc.
3. Conclusions: Summary of findings, recommendations, and next steps (i.e., what would you do if you were to download the sample malware).

3. References:

Include references to all the resources you consulted when preparing this CA (e.g., research papers, web resources, etc.)

H9MWAN WARNING

Make sure that your VM lab is fully isolated from your host and network (no shared folders, networking, etc.). Extreme caution should be paid to the second part of the CA.

You are NOT expected to download the malware onto your computer.

If you really want to download it anyway, do it only from inside the isolated VM lab (and ideally as a password-protected zip or other secure way).

You are responsible for any potential problems arising because of you downloading the malware.

If you, in any way, shape or form, inadvertently, or on purpose transmit any malware of any form to any system of NCI or another student or staff member, you will fail this module and will have to answer to the college disciplinary committee. Distributing malware is also illegal!