preview

Nt1330 Unit 3 Assignment Image Analysis

Better Essays
Open Document

To answer question 1, the malware that I found in this assignment image is the application background processes, namely ‘csrss.exe’. It runs after windows logon process complete and running under user profile. This malware will random the targeted file from the targeted location, C:\Documents and Settings\ , and start process by move targeted file from normal extension to be the extension that end with ‘1’ as show on Figure 1 on appendix A. After that, malware will send targeted file name after rename the extension to gpg2 for encryption. This means that, this malware tries to encrypt user’s information on the system by using ‘gpg2.exe’ application with specific key for encryption. The malware will call ‘gpg2.exe’ by using command line, as …show more content…

First of all, I observed windows processes by using ‘Process Monitor’ application and found the suspect processes that start and stop in the short time period. Thus, the application tools that we need to use in this challenge are ProcessExplorer and ProcessMonitor. The ProcessExploere is using for comparison all of processes in assignment image OS, Windows-XP-Assignment.ova, and normal image OS, Windows-XP.ova. This tools will help us compare the different processes list between two images and lead us to easily isolate suspect processes that running in assignment image as shown in Figure 5 and Figure 6. About the ProcessMonitor, I used to observe the behaviours’ of suspect processes such as what they do, which processes they called, and/or what are the parameters they used to participate with other applications, also all of activities that they proceed, show on Figure 7. The difficult part that I found in this stage is how malware specify the targets and key for encryption. In this challenge, the new knowledge that I learnt is the malware do not need to create all code from scratch but they can build from any security application and make worst damage to social. In this case, they use gpg application also known as PGP, that the one of security application using for encrypt and sign data for secure communication and widely use in secure email

Get Access
Related
Get Access