Cyber Security Incident Response Wannacry Ransomware
Cyber Security Incident Response Wannacry Ransomware
Duration: 5h 24m | .MP4 1280x720, 30 fps(r) | AAC, 44100 Hz, 2ch | 3.66 GB
Genre: eLearning | Language: English
Duration: 5h 24m | .MP4 1280x720, 30 fps(r) | AAC, 44100 Hz, 2ch | 3.66 GB
Genre: eLearning | Language: English
Analysis of the Wannacry Ransomware in a lab environment.
What you'll learn
Investigate and understand the behavior of the Wannacry ransomware in a lab environment using your own computer if you will.
Triage and identify indicators of compromise.
Live-analysis of the infected lab machine for windows artifacts
Static-analysis of the identified executable and artifacts
Sandbox analysis of the malicious activity, including network activity, processes, services, autoruns
Create a summary report of the incident and identify remediation recommendations
Requirements
Basic Windows knowledge (process, file, filesystem, registry)
Interest in computer forensics and malware analysis
At least one virtualization technology if you want to perform the practical tests (e.g. Virtualbox/VmWare)
Description
Wannacry has been one of the most famous ransomware in computer history (so far) which allows us to investigate how it worked and identify indicators of compromise. The goal of the course is not to protect against Wannacry, but to provide you with a methodology to be able to quickly assess the behavour of a suspicious application in a computer. The tools we are using in this course are free for personal use, but there are way more other solutions you can use for the same purpose.
At the end of this training you will have a solid understanding how the ransomware works and how to protect you environment, also you will be able to use the tools to identify and analyse other malicious tools. You will not be a malware analyst, this is not the course for that. This course will give you the steps to be able to do incident response in a quick manner and see what areas you need to develop yourself using other courses. Deep malware analysis is a very interesting area, but not necessarily the part of the incident response team. There are companies specialized in malware analysis, or people specializing in malware analysis. One can spend hours, days, weeks, months analyzing a single malware. This course aims for quick response.
Who this course is for:
People with interest in information security
People with interest in incident resposne
Security Operations Center team members
People interested to start analyzing malware
More Info
Cyber Security Incident Response Wannacry Ransomware
