================================================================================
  SANDBOX ANALYSIS REPORT — CTF Blue Team Lesson 03
  Malware Detection & Classification
================================================================================
  SAFETY NOTE: This report contains simulated sandbox output for training
  purposes only. No actual malware was executed. All IPs, domains, and
  hashes are fabricated.
================================================================================

REPORT ID:          SAND-2026-0409-00147
ANALYSIS ENGINE:    Cuckoo Sandbox v2.0.7
ANALYSIS DATE:      2026-04-09 14:23:17 UTC
ANALYSIS DURATION:  300 seconds
ENVIRONMENT:        Windows 10 Pro x64 (Build 19045) — VM Snapshot "clean-base"

================================================================================
  FILE METADATA
================================================================================

Filename:           svchost_update.exe
File Size:          483,328 bytes (472 KB)
File Type:          PE32 executable (GUI) Intel 80386, for MS Windows
MD5:                e8f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0
SHA1:               f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4e6f8a0
SHA256:             f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3
SSDeep:             12288:Xk9mQ7pLa3f7c9d1e:Xk9mQ7pLbN
Imphash:            a4b6c8d0e2f4a6b8c0d2e4f6a8b0c2d4
Compilation Time:   2026-04-01 08:15:42 UTC
Entry Point:        0x00401000
Sections:           .text, .rdata, .data, .rsrc, .reloc
Packer:             None detected (but .text section entropy: 7.21)
Digital Signature:  NOT SIGNED

================================================================================
  THREAT SCORE
================================================================================

Overall Score:      9.4 / 10.0 (MALICIOUS)

  Category Breakdown:
    Process Manipulation .... 10/10  (process injection detected)
    Persistence ............. 9/10   (registry Run key, scheduled task)
    Network Activity ........ 9/10   (C2 beacon, data exfiltration)
    Evasion ................. 8/10   (anti-VM checks, self-deletion)
    File System Activity .... 9/10   (drops files, enumerates documents)
    Data Collection ......... 10/10  (harvests documents, screenshots)

================================================================================
  BEHAVIORAL ANALYSIS
================================================================================

--- PROCESS TREE ---

svchost_update.exe (PID: 3284)
  |-- cmd.exe (PID: 4512)
  |     |-- schtasks.exe (PID: 4688)
  |-- powershell.exe (PID: 5104)
  |-- svchost.exe (PID: 2816)  [INJECTED — not a legitimate svchost instance]
        |-- cmd.exe (PID: 6240)
              |-- ping.exe (PID: 6344)

--- FILE SYSTEM ACTIVITY ---

[00:00.3]  CREATE   C:\Users\analyst\AppData\Local\Temp\~DF4A2B.tmp (122,880 bytes)
[00:00.5]  CREATE   C:\Users\analyst\AppData\Local\Temp\update.ps1 (4,096 bytes)
[00:00.7]  CREATE   C:\Users\analyst\AppData\Local\Temp\helper.vbs (1,024 bytes)
[00:01.2]  CREATE   C:\ProgramData\WindowsUpdate\config.ini (512 bytes)
[00:01.4]  CREATE   C:\ProgramData\WindowsUpdate\svchost.dat (483,328 bytes)
           NOTE:    svchost.dat is a copy of the original executable
[00:02.1]  CREATE   C:\Users\analyst\AppData\Roaming\Microsoft\Windows\svchost.dat (8,192 bytes)
           NOTE:    Encrypted configuration file — contains C2 addresses
[00:45.0]  READ     C:\Users\analyst\Documents\Q1-Financial-Report.docx
[00:45.3]  READ     C:\Users\analyst\Documents\Employee-Database.xlsx
[00:45.5]  READ     C:\Users\analyst\Documents\Project-Roadmap.pdf
[00:46.0]  CREATE   C:\Users\analyst\AppData\Local\Temp\exfil_pack.zip (245,760 bytes)
           NOTE:    ZIP archive containing copies of harvested documents
[04:55.0]  DELETE   C:\Users\analyst\AppData\Local\Temp\~DF4A2B.tmp
[04:55.2]  DELETE   C:\Users\analyst\AppData\Local\Temp\update.ps1
[04:55.4]  DELETE   C:\Users\analyst\AppData\Local\Temp\helper.vbs

--- REGISTRY MODIFICATIONS ---

[00:01.8]  SET      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
           Name:    "WindowsSystemHealth"
           Value:   "C:\ProgramData\WindowsUpdate\svchost.dat"
           NOTE:    Establishes persistence — runs on every user login

[00:02.0]  SET      HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
           Value:   "explorer.exe, C:\ProgramData\WindowsUpdate\svchost.dat"
           NOTE:    Secondary persistence — launches alongside Windows shell

[00:02.3]  SET      HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
           Name:    "ProxyEnable"
           Value:   0x00000000
           NOTE:    Disables proxy to ensure direct C2 communication

--- NETWORK ACTIVITY ---

[00:03.0]  DNS      c2.badactor.xyz -> 185.234.72.19
           Server:  8.8.8.8 (Google DNS)
[00:03.2]  TCP      SYN -> 185.234.72.19:8443
[00:03.4]  TCP      ESTABLISHED 185.234.72.19:8443
[00:03.5]  HTTP     POST http://c2.badactor.xyz:8443/beacon
           Body:    id=BOT-PC01-analyst&os=Windows+10&arch=x64&ver=1.3.7
           NOTE:    Initial check-in beacon with system fingerprint
[00:05.0]  HTTP     GET http://c2.badactor.xyz:8443/cmd
           Response: {"action":"collect","targets":["*.docx","*.xlsx","*.pdf"]}
           NOTE:    C2 issues collection command
[00:10.0]  DNS      update-service.definitelylegit.com -> 185.234.72.21
[00:10.2]  TCP      SYN -> 185.234.72.21:443
[00:10.4]  TLS      ClientHello (SNI: update-service.definitelylegit.com)
           NOTE:    Secondary C2 channel over HTTPS
[00:48.0]  HTTP     POST http://c2.badactor.xyz:8443/exfil
           Body:    [245,760 bytes — exfil_pack.zip uploaded]
           NOTE:    Stolen documents exfiltrated to C2 server
[01:00.0]  DNS      irc.undernet-servers.example.net -> 198.51.100.44
[01:00.3]  TCP      SYN -> 198.51.100.44:6667
[01:00.5]  IRC      NICK bot_PC01
           IRC      JOIN #malware-control
           IRC      PRIVMSG #malware-control :CHECKIN|PC01|analyst|Windows 10
           NOTE:    Fallback C2 channel via IRC

--- PROCESS INJECTION ---

[00:04.0]  OpenProcess(svchost.exe, PID 2816, PROCESS_ALL_ACCESS)
[00:04.1]  VirtualAllocEx(PID 2816, 0x00000000, 483328, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
           NOTE:    Allocates RWX memory in target process — highly suspicious
[00:04.2]  WriteProcessMemory(PID 2816, 0x02A40000, [payload], 483328)
           NOTE:    Writes full executable payload into svchost.exe memory
[00:04.3]  CreateRemoteThread(PID 2816, 0x02A40000)
           NOTE:    Executes injected code in context of svchost.exe
           TECHNIQUE: Classic DLL injection / process hollowing

================================================================================
  DNS QUERIES
================================================================================

Timestamp       Query                                   Response         Type
-----------     -------------------------------------   ---------------  ----
[00:03.0]       c2.badactor.xyz                         185.234.72.19    A
[00:10.0]       update-service.definitelylegit.com      185.234.72.21    A
[01:00.0]       irc.undernet-servers.example.net         198.51.100.44    A
[01:30.0]       pastebin.com                            104.20.67.143    A
[02:00.0]       c2.badactor.xyz                         185.234.72.19    A
[03:00.0]       c2.badactor.xyz                         185.234.72.19    A
[04:00.0]       c2.badactor.xyz                         185.234.72.19    A

NOTE: Beacon interval is approximately 60 seconds. DNS lookups to C2 domain
repeat at regular intervals, consistent with command-and-control polling.

================================================================================
  FILES DROPPED
================================================================================

Filename                    Path                                         Size      MD5
------------------------    -----------------------------------------    --------  --------------------------------
~DF4A2B.tmp                 %TEMP%\                                      122,880   a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2
update.ps1                  %TEMP%\                                      4,096     b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4
helper.vbs                  %TEMP%\                                      1,024     c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6
config.ini                  C:\ProgramData\WindowsUpdate\                512       d8e0f2a4b6c8d0e2f4a6b8c0d2e4f6a8
svchost.dat                 C:\ProgramData\WindowsUpdate\                483,328   e8f2a4b6c8d0e2f4a6b8c0d2e4f6a8b0
svchost.dat                 %APPDATA%\Microsoft\Windows\                 8,192     f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0
exfil_pack.zip              %TEMP%\                                      245,760   a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0

NOTE: The %TEMP% files (~DF4A2B.tmp, update.ps1, helper.vbs) are deleted after
use — classic anti-forensics behavior. Only persistent files remain on disk.

================================================================================
  MUTEXES CREATED
================================================================================

Name                                    Purpose (Inferred)
--------------------------------------  ------------------------------------------
Global\SvcHostUpdateMutex_7B2F          Prevents multiple instances from running
Global\WindowsSystemHealthCheck         Associated with scheduled task persistence
Local\ShellExperienceHost_Mutex         Mimics legitimate Windows mutex name

NOTE: Mutex names are chosen to blend in with legitimate Windows objects.
"Global\SvcHostUpdateMutex_7B2F" is the primary infection marker — if this
mutex exists on a system, the host is compromised.

================================================================================
  MITRE ATT&CK MAPPING
================================================================================

Tactic              Technique ID    Technique Name
------------------  -----------     -------------------------------------------
Execution           T1059.001       PowerShell
Execution           T1059.003       Windows Command Shell
Persistence         T1547.001       Registry Run Keys / Startup Folder
Persistence         T1053.005       Scheduled Task
Defense Evasion     T1055.001       DLL Injection
Defense Evasion     T1070.004       File Deletion
Defense Evasion     T1036.005       Match Legitimate Name (svchost)
Discovery           T1082           System Information Discovery
Discovery           T1083           File and Directory Discovery
Collection          T1005           Data from Local System
Collection          T1560.001       Archive via Utility (ZIP)
Exfiltration        T1041           Exfiltration Over C2 Channel
Command & Control   T1071.001       Web Protocols (HTTP/HTTPS)
Command & Control   T1071.002       IRC Protocol
Command & Control   T1573.001       Encrypted Channel (TLS)
Command & Control   T1571           Non-Standard Port (8443)

================================================================================
  VERDICT
================================================================================

Classification:     TROJAN / RAT (Remote Access Trojan) with data theft capability
Confidence:         HIGH (9.4/10)
Recommended Action: Quarantine immediately. Hunt for IOCs across all endpoints.
                    Block C2 domains and IPs at perimeter firewall.
                    Check all systems for mutex "Global\SvcHostUpdateMutex_7B2F".

IOCs for Detection:
  - Domain: c2.badactor.xyz
  - Domain: update-service.definitelylegit.com
  - Domain: irc.undernet-servers.example.net
  - IP: 185.234.72.19 (port 8443)
  - IP: 185.234.72.21 (port 443)
  - IP: 198.51.100.44 (port 6667)
  - File: C:\ProgramData\WindowsUpdate\svchost.dat
  - Registry: HKCU\...\Run\WindowsSystemHealth
  - Mutex: Global\SvcHostUpdateMutex_7B2F
  - User-Agent: Mozilla/5.0 (exact match from beacon)
  - SHA256: f1a3b5c7d9e1f3a5b7c9d1e3f5a7b9c1d3e5f7a9b1c3d5e7f9a1b3c5d7e9f1a3

================================================================================
  CHALLENGE: Using this report, write a comprehensive incident response plan.
  What would you block first? How would you hunt for lateral movement?
  Which IOCs are most reliable for detection across your environment?
================================================================================
