🛡️ Malware Analysis Lab Report

Overview

This repository documents the analysis of a malware sample provided during a summer cybersecurity bootcamp.
The project focused on executing the malware in a safe isolated environment, capturing its behavior, and extracting Indicators of Compromise (IOCs).

Objectives

• Safely execute malware in a controlled Windows 10 VM.
• Capture network traffic and identify suspicious domains/IPs.
• Acquire a full memory dump and analyze it using forensic tools.
• Extract IOCs and map findings to MITRE ATT&CK techniques.
• Produce a professional incident response–style report.

Lab Setup

• Isolated VM: Windows 10 with firewall/AV disabled, private network, snapshots enabled.
• Tools Used:
  • FTK Imager → Memory acquisition
  • Volatility3 → Memory forensic analysis
  • Wireshark & Tshark → Network traffic capture and filtering

Key Findings

• Suspicious domain: fpdownload.macromedia.com
• Resolved IP: 23.39.69.211
• Malicious processes observed:
  • InstallFlashPlayer.exe
  • SkypeApp.exe / SkypeBridge.exe / SkypeBackgroundHost.exe

MITRE ATT&CK Mapping

• T1204 – User Execution
• T1071.001 – Application Layer Protocol: DNS
• T1105 – Ingress Tool Transfer
• T1055 – Process Injection

Repository Contents

• 📄 Malware_Analysis_Report.pdf → Full detailed report with screenshots
• 🕵️ capture.pcapng → Wireshark capture file
• 💾 Memory Dump → Download Link (~1.7 GB, compressed)

Recommendations

• Block malicious domains/IPs at network perimeter.
• Harden email and web filtering to prevent initial infection vectors.
• Maintain endpoint monitoring to detect anomalous processes.
• Provide user awareness training on fake installers.

---

Disclaimer

⚠️ This repository is for educational purposes only.
The malware sample was provided in a controlled bootcamp environment and is not shared publicly.