Reference no: EM132931163

CO7606 Digital Forensics and Incident Response - University of CHESTER

Learning Outcome 1: Analyse malware and perform intrusion analysis
Learning Outcome 2: Use operational techniques effectively to provide attribution details on a cyber attack
Learning Outcome 3: Determine the use of anti-forensics methods/techniques and falsification
Learning Outcome 4: Craft and justify a measured incident response plan

Assignment Brief

Introduction

You are working as a Digital Forensics and Incident Response officer for the company "Incident Response for You" (referred to as IR4U).

IR4U has just been contracted by a company, Driving Solutions to provide them support in identifying an ongoing breach in their company. They identified this breach from their ISP reporting 200GB more bandwidth going out of their network than normal. They suspect that files are being exfiltrated from their network.

About Driving Solutions

Driving Solutions is a national local company based at Chester. They employ 10 staff comprising of:
- 2x Administration staff who organise the client appointments with the driving instructors
o The two staff job share, one working Mon-Wed, and the other Thurs-Fri. There is 1x Windows 7 desktop machine in use which stays onsite, and they both share this computer.
- 6x Driving instructors
o These staff do not use the computers on site.
- 1x Car Mechanic
o The mechanic uses his own Windows 10 laptop he brings in from home.
- 1x CEO
o The CEO has a MacBook pro 2012 running macOS Catalina. That's the latest version the laptop will run. He brings this between work and home.

They do not employ IT staff, instead relying on a friend of the CEO who comes in when needed to help with any problems or setting up new computer equipment.

Task 1:

Driving Solutions Uncovers Malware

A malicious MS Word Document file has been found on the Windows 7 machine which had been received by email and previously opened, some time ago. This is noted to have previously cause business continuity issues, so the Windows 7 machine was rebooted and everything then seemed ok.
(Note: File available on the VLE platform)

Study this file, and provide detailed information about it, including what the malware did and how to fix what it did. Also cover how this can be prevented in the future.

More marks will be given for analysis which finds each part of the code in the malware and shows understanding of what each part does. Documentation is very important and the company expects a high level of detailed analysis so that they can ensure their customers that this is handled and measures are in place for the future to prevent this.

Be sure to remark on whether this malicious document and its payload is or can be associated with the exfiltration of the data reported by the high bandwidth usage.

This Word Document will lead you onto another file which you also need to analyse and provide details on what it does.

Task 2:

Your IR4U colleague has checked the email that was sent containing the Word Document from Task 1. They have uploaded this (containing all the email headers) for you to download.

By using both the Word Document, and the email just mentioned, you are to use this to attempt attribution of the attacker in question. You are to also attempt to identify what type of threat actor this attacker is. Eg. APT, Organised Crime, Script Kiddie, or other. Give detail and justification behind this judgement made including a percentage of how accurate this attribution is.

Task 3:

Your colleague at IR4U has started checking over the other computers connected on the company's network by running a malware scan on each computer. They found several more malware files on this Windows 7 computer so far and nothing on the other computers.

You are to perform malware analysis on the files provided. In addition to stating what the malware does, you are to discuss the anti-forensics/anti-analysis techniques present. These techniques will be present in one or more files.

You suspect that malware might have spread to the other computers and not been detected by the anti-virus. You are to discuss the process of ‘threat hunting' across the other computers on the network. Propose a plan including tools and techniques that should be used to help audit these other computers for signs of infection in the organisation? E.g. Network traffic analysis for command and control? Ram analysis?

Task 4:

This whole incident has made the CEO realise that they are not prepared to deal with issues like this. They have asked you to formulate an incident response plan for the future to help better prepare for when this happens again.

You are to detail the entire process (preparation, identification, containment, and so on...) - What tools and techniques could the organisation use to help plan better for when this happens.

Additionally, you should make use of the Cyber Kill Chain to discuss what has happened via the Word Document phishing attack in Task 1.

Attachment:- Digital Forensics and Incident Response.rar