Understanding Malware Attack Chains

As a malware analyst, you’ll often need to investigate how malware infects a computer from start to finish. Threat actors don’t typically tend to distribute the final stage malware payload directly. Instead, they break the attack into several steps, often referred to as a kill chain.

Here’s how a typical attack might work

For example, imagine someone receives a suspicious email with an attachment. When they open it, here’s what happens:

1. The attachment is a zip file containing a JavaScript file
2. When opened, this JavaScript file runs on the computer using a built-in framework known as WScript
3. The JavaScript connect to an attacker-controlled url and downloads a malware loader
4. The loader fetches and runs the malicious payload, often in memory

Why does this matter?

These attack chains can be fairly complex and may involve different programming languages at each step. Many threats download and run payloads in memory, avoiding saving malicious files to disk. This is key to reducing antivirus detections, as well as hindering analysis. Understanding different malware kill chains is an essential skill for malware analysts.

What you’ll be doing

In these challenges, you’ll work with example attack chains designed to mirror real world malware seen in the wild. Your goal is to trace each step of the chain until you reach the final payload, which contains a hidden flag. These exercises are more challenging than other labs, but they’ll give you hands-on experience with more realistic malware analysis.

Good luck, and have fun!

Once you accept the warning, you’ll be taken to a phishing page designed to lure users into running malicious commands. You’ll need to extract the malicious command from the web page, then reverse engineer it to find the next stage. In the final stage payload you’ll find the flag.

Recommended Environment

Host Machine: Anything with an x86_64 CPU (32-bit CPUs won’t work and ARM CPUs will require an emulator).
Virtual Machine: VMware or VirtualBox
Operating System: Windows 10 64-bit
Disassembler: Binary Ninja or Ghidra

Note: for Windows Labs the walkthrough videos will be done using Binary Ninja, with a 64-bit Windows 10 Virtual Machine running on VMWare Workstation Pro. You are free to choose your own software & hardware, just be aware that there will only be official support for the recommendations listed above, any custom setups are your own responsibility.