Incident Response: Cryptolocker Crime Investigation
[Back] A crime has been suspected around Cryptolocker activity, and the incident response team have captured evidence related to the suspected crime. It is thus your objective to investigate the virtual image, and produce a fair and unbiased report on the findings. The VM image exists within the Napier DFET Cloud in the Production-> Cryptolocker folder (crypto_001, crypto_002, and so on), which also contacts the network trace, which can also be downloaded from [PDF]: here
The analysis should involve analysing the network trace for the connections from the hosts which connected to the host-under-suspicion (HUS). Along with this you should analyse and cross-correlate the activity within the logs on the HUS, and the trace of files left on the system. Evidence should also be gained from the applications which were used within the time window of interest. Please note that all other activity outside this window-of-interest should be ignored.
The coursework should be submitted via Turnitin, in a PDF format, if possible, on Monday 27 April 2015. It will be marked as follows:
The report should use the APA/Harvard format for all of the references, and, if possible, should include EVERY reference to material sourced from other places. Also, the report should be up to 20 pages long (where appendices do not count in the page count number).
There are multiple communications within the network trace, some of which have possible malicious intent, and others which are normal non-malicious content. As part of the analysis you should: