Question

IS 3523 Malware Analysis One of our client's machines may have been compromised by some ferocious malware. The CISO has declared an "incident" and now wants you to investigate the compromised box to determine what might be going on. The machine is located at their "super secret" engineering facility, but we are fortunate to have a virtual image of the compromised FTP Server on the SimSpace range. You can conduct a root cause analysis of the FTP server using any tools you find useful on SimSpace. You get this right and you get a permanent slot on the incident response team...if you don't, more work on the help desk. Accessing the Compromised VM To access the FTP server you will need to login to your SimSpace account. Once logged in, access the range and find an available win-xp-xx VM. Click on the win-xp-xx, select the Network Tab, and record the IP address of the interface on the ISCS-Security Subnet connection. Open the win-xp-xx VM by selecting Open Console. Record what you see. At this point you will leave this VM alone for now. Treat it as the "suspect machine". Select another VM on the range you wish to use to analyze the FTP Server. Once this is done, login to your selected VM and open a terminal window. In the terminal window try pinging the win-xp-xx VM that you opened. You can locate the IP address of your machine on the Network Map page located under Visualizations on the left-hand side of the screen. If you can ping your win-xp-xx VM, you are ready to go.

IS 3523
Malware Analysis
One of our client's machines may have been compromised by some ferocious malware. The CISO has
declared an "incident" and now wants you to investigate the compromised box to determine what might
be going on. The machine is located at their "super secret" engineering facility, but we are fortunate to
have a virtual image of the compromised FTP Server on the SimSpace range. You can conduct a root
cause analysis of the FTP server using any tools you find useful on SimSpace. You get this right and you
get a permanent slot on the incident response team...if you don't, more work on the help desk.
Accessing the Compromised VM
To access the FTP server you will need to login to your SimSpace account. Once logged in, access the
range and find an available win-xp-xx VM. Click on the win-xp-xx, select the Network Tab, and record
the IP address of the interface on the ISCS-Security Subnet connection. Open the win-xp-xx VM by
selecting Open Console. Record what you see. At this point you will leave this VM alone for now. Treat it
as the "suspect machine".
Select another VM on the range you wish to use to analyze the FTP Server. Once this is done, login to
your selected VM and open a terminal window. In the terminal window try pinging the win-xp-xx VM
that you opened. You can locate the IP address of your machine on the Network Map page located
under Visualizations on the left-hand side of the screen.
If you can ping your win-xp-xx VM, you are ready to go.

Added by Cristina J.

Question

Please give Ace some feedback