================================================================================ SANDBOX ANALYSIS REPORT — CTF Blue Team Lesson 03 Malware Detection & Classification ================================================================================ SAFETY NOTE: This report contains simulated sandbox output for training purposes only. No actual malware was executed. All IPs, domains, and hashes are fabricated. ================================================================================ REPORT ID: SAND-2026-0409-00147 ANALYSIS ENGINE: Cuckoo Sandbox v2.0.7 ANALYSIS DATE: 2026-04-09 14:23:17 UTC ANALYSIS DURATION: 300 seconds ENVIRONMENT: Windows 10 Pro x64 (Build 19045) — VM Snapshot "clean-base" ================================================================================ FILE METADATA ================================================================================ Filename: svchost_update.exe File Size: 483,328 bytes (472 KB) File Type: PE32 executable (GUI) Intel 80386, for MS Windows MD5: e8f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0 SHA1: f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0 SHA256: f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3 SSDeep: 12288:Xk9mQ7pLa3f7c9d1e:Xk9mQ7pLbN Imphash: a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4 Compilation Time: 2026-04-01 08:15:42 UTC Entry Point: 0x00401000 Sections: .text, .rdata, .data, .rsrc, .reloc Packer: None detected (but .text section entropy: 7.21) Digital Signature: NOT SIGNED ================================================================================ THREAT SCORE ================================================================================ Overall Score: 9.4 / 10.0 (MALICIOUS) Category Breakdown: Process Manipulation .... 10/10 (process injection detected) Persistence ............. 9/10 (registry Run key, scheduled task) Network Activity ........ 9/10 (C2 beacon, data exfiltration) Evasion ................. 8/10 (anti-VM checks, self-deletion) File System Activity .... 9/10 (drops files, enumerates documents) Data Collection ......... 10/10 (harvests documents, screenshots) ================================================================================ BEHAVIORAL ANALYSIS ================================================================================ --- PROCESS TREE --- svchost_update.exe (PID: 3284) |-- cmd.exe (PID: 4512) | |-- schtasks.exe (PID: 4688) |-- powershell.exe (PID: 5104) |-- svchost.exe (PID: 2816) [INJECTED — not a legitimate svchost instance] |-- cmd.exe (PID: 6240) |-- ping.exe (PID: 6344) --- FILE SYSTEM ACTIVITY --- [00:00.3] CREATE C:\Users\analyst\AppData\Local\Temp\~DF4A2B.tmp (122,880 bytes) [00:00.5] CREATE C:\Users\analyst\AppData\Local\Temp\update.ps1 (4,096 bytes) [00:00.7] CREATE C:\Users\analyst\AppData\Local\Temp\helper.vbs (1,024 bytes) [00:01.2] CREATE C:\ProgramData\WindowsUpdate\config.ini (512 bytes) [00:01.4] CREATE C:\ProgramData\WindowsUpdate\svchost.dat (483,328 bytes) NOTE: svchost.dat is a copy of the original executable [00:02.1] CREATE C:\Users\analyst\AppData\Roaming\Microsoft\Windows\svchost.dat (8,192 bytes) NOTE: Encrypted configuration file — contains C2 addresses [00:45.0] READ C:\Users\analyst\Documents\Q1-Financial-Report.docx [00:45.3] READ C:\Users\analyst\Documents\Employee-Database.xlsx [00:45.5] READ C:\Users\analyst\Documents\Project-Roadmap.pdf [00:46.0] CREATE C:\Users\analyst\AppData\Local\Temp\exfil_pack.zip (245,760 bytes) NOTE: ZIP archive containing copies of harvested documents [04:55.0] DELETE C:\Users\analyst\AppData\Local\Temp\~DF4A2B.tmp [04:55.2] DELETE C:\Users\analyst\AppData\Local\Temp\update.ps1 [04:55.4] DELETE C:\Users\analyst\AppData\Local\Temp\helper.vbs --- REGISTRY MODIFICATIONS --- [00:01.8] SET HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Name: "WindowsSystemHealth" Value: "C:\ProgramData\WindowsUpdate\svchost.dat" NOTE: Establishes persistence — runs on every user login [00:02.0] SET HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell Value: "explorer.exe, C:\ProgramData\WindowsUpdate\svchost.dat" NOTE: Secondary persistence — launches alongside Windows shell [00:02.3] SET HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: "ProxyEnable" Value: 0x00000000 NOTE: Disables proxy to ensure direct C2 communication --- NETWORK ACTIVITY --- [00:03.0] DNS c2.badactor.xyz -> 185.234.72.19 Server: 8.8.8.8 (Google DNS) [00:03.2] TCP SYN -> 185.234.72.19:8443 [00:03.4] TCP ESTABLISHED 185.234.72.19:8443 [00:03.5] HTTP POST http://c2.badactor.xyz:8443/beacon Body: id=BOT-PC01-analyst&os=Windows+10&arch=x64&ver=1.3.7 NOTE: Initial check-in beacon with system fingerprint [00:05.0] HTTP GET http://c2.badactor.xyz:8443/cmd Response: {"action":"collect","targets":["*.docx","*.xlsx","*.pdf"]} NOTE: C2 issues collection command [00:10.0] DNS update-service.definitelylegit.com -> 185.234.72.21 [00:10.2] TCP SYN -> 185.234.72.21:443 [00:10.4] TLS ClientHello (SNI: update-service.definitelylegit.com) NOTE: Secondary C2 channel over HTTPS [00:48.0] HTTP POST http://c2.badactor.xyz:8443/exfil Body: [245,760 bytes — exfil_pack.zip uploaded] NOTE: Stolen documents exfiltrated to C2 server [01:00.0] DNS irc.undernet-servers.example.net -> 198.51.100.44 [01:00.3] TCP SYN -> 198.51.100.44:6667 [01:00.5] IRC NICK bot_PC01 IRC JOIN #malware-control IRC PRIVMSG #malware-control :CHECKIN|PC01|analyst|Windows 10 NOTE: Fallback C2 channel via IRC --- PROCESS INJECTION --- [00:04.0] OpenProcess(svchost.exe, PID 2816, PROCESS_ALL_ACCESS) [00:04.1] VirtualAllocEx(PID 2816, 0x00000000, 483328, MEM_COMMIT, PAGE_EXECUTE_READWRITE) NOTE: Allocates RWX memory in target process — highly suspicious [00:04.2] WriteProcessMemory(PID 2816, 0x02A40000, [payload], 483328) NOTE: Writes full executable payload into svchost.exe memory [00:04.3] CreateRemoteThread(PID 2816, 0x02A40000) NOTE: Executes injected code in context of svchost.exe TECHNIQUE: Classic DLL injection / process hollowing ================================================================================ DNS QUERIES ================================================================================ Timestamp Query Response Type ----------- ------------------------------------- --------------- ---- [00:03.0] c2.badactor.xyz 185.234.72.19 A [00:10.0] update-service.definitelylegit.com 185.234.72.21 A [01:00.0] irc.undernet-servers.example.net 198.51.100.44 A [01:30.0] pastebin.com 104.20.67.143 A [02:00.0] c2.badactor.xyz 185.234.72.19 A [03:00.0] c2.badactor.xyz 185.234.72.19 A [04:00.0] c2.badactor.xyz 185.234.72.19 A NOTE: Beacon interval is approximately 60 seconds. DNS lookups to C2 domain repeat at regular intervals, consistent with command-and-control polling. ================================================================================ FILES DROPPED ================================================================================ Filename Path Size MD5 ------------------------ ----------------------------------------- -------- -------------------------------- ~DF4A2B.tmp %TEMP%\ 122,880 a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2 update.ps1 %TEMP%\ 4,096 b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4 helper.vbs %TEMP%\ 1,024 c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6 config.ini C:\ProgramData\WindowsUpdate\ 512 d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8 svchost.dat C:\ProgramData\WindowsUpdate\ 483,328 e8f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0 svchost.dat %APPDATA%\Microsoft\Windows\ 8,192 f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0 exfil_pack.zip %TEMP%\ 245,760 a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0 NOTE: The %TEMP% files (~DF4A2B.tmp, update.ps1, helper.vbs) are deleted after use — classic anti-forensics behavior. Only persistent files remain on disk. ================================================================================ MUTEXES CREATED ================================================================================ Name Purpose (Inferred) -------------------------------------- ------------------------------------------ Global\SvcHostUpdateMutex_7B2F Prevents multiple instances from running Global\WindowsSystemHealthCheck Associated with scheduled task persistence Local\ShellExperienceHost_Mutex Mimics legitimate Windows mutex name NOTE: Mutex names are chosen to blend in with legitimate Windows objects. "Global\SvcHostUpdateMutex_7B2F" is the primary infection marker — if this mutex exists on a system, the host is compromised. ================================================================================ MITRE ATT&CK MAPPING ================================================================================ Tactic Technique ID Technique Name ------------------ ----------- ------------------------------------------- Execution T1059.001 PowerShell Execution T1059.003 Windows Command Shell Persistence T1547.001 Registry Run Keys / Startup Folder Persistence T1053.005 Scheduled Task Defense Evasion T1055.001 DLL Injection Defense Evasion T1070.004 File Deletion Defense Evasion T1036.005 Match Legitimate Name (svchost) Discovery T1082 System Information Discovery Discovery T1083 File and Directory Discovery Collection T1005 Data from Local System Collection T1560.001 Archive via Utility (ZIP) Exfiltration T1041 Exfiltration Over C2 Channel Command & Control T1071.001 Web Protocols (HTTP/HTTPS) Command & Control T1071.002 IRC Protocol Command & Control T1573.001 Encrypted Channel (TLS) Command & Control T1571 Non-Standard Port (8443) ================================================================================ VERDICT ================================================================================ Classification: TROJAN / RAT (Remote Access Trojan) with data theft capability Confidence: HIGH (9.4/10) Recommended Action: Quarantine immediately. Hunt for IOCs across all endpoints. Block C2 domains and IPs at perimeter firewall. Check all systems for mutex "Global\SvcHostUpdateMutex_7B2F". IOCs for Detection: - Domain: c2.badactor.xyz - Domain: update-service.definitelylegit.com - Domain: irc.undernet-servers.example.net - IP: 185.234.72.19 (port 8443) - IP: 185.234.72.21 (port 443) - IP: 198.51.100.44 (port 6667) - File: C:\ProgramData\WindowsUpdate\svchost.dat - Registry: HKCU\...\Run\WindowsSystemHealth - Mutex: Global\SvcHostUpdateMutex_7B2F - User-Agent: Mozilla/5.0 (exact match from beacon) - SHA256: f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3 ================================================================================ CHALLENGE: Using this report, write a comprehensive incident response plan. What would you block first? How would you hunt for lateral movement? Which IOCs are most reliable for detection across your environment? ================================================================================