Scribd
Upload
5 views3 pages

Malware_Investigation_Report_BrightTech

The malware investigation report details the analysis of logs from a compromised system, revealing privilege escalation, unauthorized credential validation, and the presence of malware files. The findings indicate significant risks to system integrity and confidentiality due to unauthorized access and potential data exfiltration. Recommended remediation actions include isolating the infected system, performing malware scans, and enhancing cybersecurity training and measures.

Uploaded by

kamal furqan bello
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
5 views3 pages

Malware_Investigation_Report_BrightTech

The malware investigation report details the analysis of logs from a compromised system, revealing privilege escalation, unauthorized credential validation, and the presence of malware files. The findings indicate significant risks to system integrity and confidentiality due to unauthorized access and potential data exfiltration. Recommended remediation actions include isolating the infected system, performing malware scans, and enhancing cybersecurity training and measures.

Uploaded by

kamal furqan bello
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 3

Malware Investigation Report

1. Logs and Evidence Collected

The following logs were analyzed from the suspected malware-infected system:

• Windows Event Logs (Event Viewer)


- Security Logs:
- Event ID 4672: Special privileges assigned to new logon (User: UnknownUser)
- Event ID 4776: Credential validation attempt (User: SYSTEM, Source IP: 198.51.100.10)
- Application Logs:
- Event ID 1015: Faulting application explorer.exe with faulting module injected.dll
- System Logs:
- Event ID 7034: Windows Update Service terminated unexpectedly

• Firewall and Network Logs


- Outbound Connections:
- 2024-04-01 14:45: Connection from 192.168.50.23 to 203.0.113.5:22 (Allowed)
- 2024-04-01 14:50:30: Connection from 192.168.50.23 to 192.0.2.89:9090 (Allowed)
- Unauthorized Access Attempts:
- 2024-04-01 15:12: Blocked attempt from 198.51.100.10 to 192.168.50.23

• Antivirus/Endpoint Protection Logs


- 2024-04-01 15:30: Detected Worm.Autorun.Script at C:\Users\Guest\Documents\
hidden.vbs (Suspended)
- 2024-04-01 16:00: Detected Trojan Downloader at C:\ProgramData\startup.bat
(Quarantined)

2. Indicators of Compromise (IoCs)


Indicator of Compromise Description Evidence Collected
(IoC)

UnknownUser Privilege Suspicious user assigned Event ID 4672


Escalation special privileges

Unauthorized Credential System user tried to Event ID 4776, IP:


Validation validate credentials 198.51.100.10

Injected DLL Explorer.exe faulted due to Event ID 1015


injected module

Disabled Security Service Windows Update Service Event ID 7034


terminated unexpectedly

Outbound TCP Port Unusual external Firewall logs


22/9090 connections

Malware Files Detected Worm and Trojan Antivirus logs

3. Summary of Findings and Analysis

An infected machine exhibited unusual behavior including slow performance, pop-up ads,
and unauthorized network connections. Logs revealed a privilege escalation by an unknown
user, failed credential validations, DLL injection into explorer.exe, and the termination of a
core Windows service. Network logs indicated suspicious outbound connections, and
antivirus logs confirmed the presence of malware files including a Trojan Downloader and a
Worm script.

Impact: The system was compromised, potentially allowing remote access and data
exfiltration. System integrity and confidentiality were at risk.

4. Recommended Remediation Actions

• Immediately isolate the infected system from the network.


• Perform a full malware scan using updated antivirus and EDR tools.
• Remove/quarantine all detected threats.
• Patch all vulnerable software and OS components.
• Reset all credentials, especially for affected systems and privileged accounts.
• Review firewall and network configurations to prevent external command & control
communication.
• Enable multi-factor authentication (MFA).
• Train staff on phishing and malware awareness.

5. Lessons Learned and Preventive Measures

• Ensure all employees receive regular cybersecurity awareness training.


• Implement strict privilege management and monitoring.
• Keep security services and definitions up-to-date.
• Separate backup systems from production networks.
• Monitor and analyze system logs regularly.
• Employ endpoint protection with behavioral analysis capabilities.

You might also like