u/hjb1002

Im just graduated from college and currently an intern, after finishing the book they ask me to find a malware family on malpedia and start analyze a sample of that family. Im only working with malware within the book labs before. What sample should I start with? Thank you very much

Update

Im end up choosing the sample: c012d6850b13e52312b40cff42d444126d137a1ac88f5e77158b5089f6ed25ac

At first it is not packed and im thinking "Thank god" but after looking at the import table and strings within the malware, it may have a lot of components like:

Keylogger

Credential Stealing (browser, mail client)

Process injection

UAC bypass, create backdoor user

Persistence + Defender exclusion

Remote shell

It is the first time I work with malware this complicated, totally different from the labs.

Where or how should I start analyzing the functions with IDA Pro? Thank you in advance

FLARE-VM is a free, open-source Windows virtual machine environment made for malware analysis. I create one a long time ago and now I need it for my study. But I forgot the password don't know how to retrieve it. I can still use it with a very old snapshot but it keep shuting down mid uses, and I don't think what a good idea anyway.

The VM is using Windows 10 iso and a pain in the ahhs to make a new one, which is why im asking the question. Im using Vmware Workstation pro 17.

This is kind of a long question so please bear with me. This is what I need to do:

- Create a website on windows server using IIS, what allow user to upload a file to a folder on the server. Don't need database, don't need to know who upload what, just click a button, choose the file then upload it.

- Exploit the website (don't need to be complicated) by uploading a web shell to it

- Get Wazuh to detect the activity of the web shell

What Im already done:

- Installed both the windows servers and Wazuh server on Vmware Workstation.

- Win server is an active agent of Wazuh server

- Install IIS and Wazuh server can see the default website

Using Wazuh 4.12.0, Win server 2022.

Wazuh server IP is 192,168,2,2 , Win server IP is 192,168,1,2. They are connected through a pfSense n firewall (not important tbh)

I have absolutely no idea where to start on this demo. Dont know how to make the web, never work with a real web shell.

All of this is on my personal laptop so lacking RAM and others hardware requirements also bugging me out.

This is the end of the question, thank for your time. If you want to know why I need this demo or really, just a brat complaining, you can continue:

I just graduated from college in cybersecurity, and it a "my dad know a guy" situation so Im start being an intern at a SOC department. 4 days in and I was requested to make this demo. Completely flabbergasted by how dumb I am, I was to naive to think just getting through the semester back then is enough. I just feel really lost by now.

The version im using is v4.12.0

Both of the rule are for a Window 10 agent on vmware workstation, they are just for testing and not on real system if you know what i mean.

The first rule is to send an alert after some failed login attemps, this is my version:

<rule id="100002" level="15" frequency="3" timeframe="120">

<if_matched_sid>60122</if_matched_sid>

<same_field>win.evendata.ipAddress</same_field>

<description>Multiple failed login attemps in 2 minutes</description>

</rule>

and when I test the rule by going to lock screen and enter incorrect password multiple times, the rule work just fine.

But the second rule (let call it 100003), which is to check if 10 second after the 100002 rule was alerted, if there are success login attemp then if will fire with something like "Login successfully after multiple failed attemps"

The rule id for success login is 60118

How do I write the second rule, please help me