Cyber Security Incident Response Wannacry Ransomware

Analysis of the Wannacry Ransomware in a lab environment.

Created by: Balazs Lendvay
Information Security Engineer/Incident Response Manager

What Will I Learn?

• Investigate and understand the behavior of the Wannacry ransomware in a lab environment using your own computer if you will.
• Triage and identify indicators of compromise.
• Live-analysis of the infected lab machine for windows artifacts
• Static-analysis of the identified executable and artifacts
• Sandbox analysis of the malicious activity, including network activity, processes, services, autoruns
• Create a summary report of the incident and identify remediation recommendations

Requirements

• Basic Windows knowledge (process, file, filesystem, registry)
• Interest in computer forensics and malware analysis
• At least one virtualization technology if you want to perform the practical tests (e.g. Virtualbox/VmWare)

Target audience

• People with interest in information security
• People with interest in incident resposne
• Security Operations Center team members
• People interested to start analyzing malware