Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: End of Year Traffic Analysis Quiz SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
End of Year Traffic Analysis Quiz

Introduction

I wanted to leave you all with one final traffic analysis quiz for Windows-based malware infection traffic.  You can find the pcaps here.  Today's exercise has 6 pcaps of different Windows-based malware infections.  Your task for this quiz?  Determine what type of malware caused the infection for each pcap.  I didn't provide any alerts like I've done for previous quizes.  Today's quiz is just a casserole of pcap files, cooked up, and served piping hot!


Shown above: A food-based visual for this end-of-year traffic analysis quiz.

A PDF document of answers is also included on the page I linked to earlier.  The answers contains associated IOCs for the infections that can be extracted from the pcaps.  But don't peek!  First, see how much you can determine from examining the pcaps.

Requirements

This type of analysis requires Wireshark.  Wireshark is my tool of choice to review pcaps of infection activity.  However, default settings for Wireshark are not optimized for web-based malware traffic.  That's why I encourage people to customize Wireshark after installing it.  To help, I've written a series of tutorials.  The ones most helpful for this quiz are:

Furthermore, I  recommend using a non-Windows environment like BSD, Linux, or macOS to analyze malicious traffic.  Some of these pcaps contain HTTP traffic sending Windows-based malware.  If you're using a Windows host to review the pcaps, your antivirus (or Windows Defender) may delete the pcap or malware.  Worst case scenario?  If you extract the malware from the pcaps and accidentally run the files, you might infect your Windows computer.

So beware, because there's actual malware involved in parts of this quiz.

Final words

Hope everyone has a happy and healthy year as we enter 2021.

Again, the pcaps and answers for this end-of-year traffic analysis quiz can be found here.

---
Brad Duncan
brad [at] malware-traffic-analysis.net

Brad

417 Posts
ISC Handler
Dec 31st 2020

Sign Up for Free or Log In to start participating in the conversation!