Malware Analysis Lab 3: Basic Dynamic Analysis

How you will be graded

Create Lab Report with the screenshots and analysis for each of the exercises below. For each exercise you must answer the following questions:

1. For this analysis, what forensic technique category, forensic technique and tool did you use?
2. Why do you perform this analysis?
3. What was your findings and your analysis of analysis?

Name the lab report file ‘Lastname_MAL3 Lab Report’ and submit it in Blackboard assignment Malware Analysis Lab 3

Lab background

• Malware Analysis Technique Category: Basic Dynamic Analysis
• Forensic Tool: Nmap
• Forensic Tool Vendor Site:

1. Nmap: https://nmap.org/

• Forensic Tool Description: Nmap (“Network Mapper”) is a free and open source (license) utility for network discovery and security auditing.^[1]

Lab Configuration Requirements

Virtual Machines: Win2008-NETLAB VM and Kali-Linux-2018.3-vm-i386

1. Follow lab configuration instructions in ‘Malware Analysis Lab 2 Lab Setup Instructions.docx’
2. Make sure INetSim simulation is running on Kali-Linux-2018.3-vm-i386 VM
3. On the Win2008-NETLAB VM, configure Kali-Linux-2018.3-vm-i386 VM as DNS Server

Exercise 1. Nmap to scan YOURNAME.com

Start Nmap. Enter a Target of YOURNAME.com, replacing “YOURNAME” with your own name.

Click the Scan button.

You should see a lot of open ports, as shown below.

Saving a Screen Image

Make sure the Nmap window shows these two things:

• A long list of open ports is visible in the Nmap window, as shown above.

Note: If you wait too long, the scan will complete and scroll to the bottom. Drag the scroll bar back to the top to capture the image shown above.

• YOUR NAME in the Target field

Click the taskbar at the bottom of your host Windows 10 desktop, to make the host machine listen to the keyboard, instead of the virtual machine.

Press the PrintScrn key to copy the whole desktop to the clipboard.

Paste the image into Paint.

Save the document with the filename “PMAL3_E1_YourName”, replacing “YOUR NAME” with your real name.

[1] Source: https://nmap.org/