Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Cyber Security Incident Response Wannacry Ransomware
Rating: 4.1 out of 5(154 ratings)
1,894 students
Created byBalazs Lendvay
Last updated 10/2020
English

What you'll learn

  • Investigate and understand the behavior of the Wannacry ransomware in a lab environment using your own computer if you will.
  • Triage and identify indicators of compromise.
  • Live-analysis of the infected lab machine for windows artifacts
  • Static-analysis of the identified executable and artifacts
  • Sandbox analysis of the malicious activity, including network activity, processes, services, autoruns
  • Create a summary report of the incident and identify remediation recommendations

Course content

9 sections • 55 lectures • 5h 24m total length

  • 01.01 Introduction12:16

    Introduction to the training and the instructor.

  • 01.02 What is Wannacry?4:49

    Short introduction to the Wannacry ransomware and it's impact.

  • 01.03 Scenario1:23

    Introduction to our scenario we will walk through in the training.

  • 01.04 Supporting Materials0:11

    Please see the supporting material attached. Download this before proceeding to the next section.

    The info.txt has most of the links and commands you might need to use during the course.

    The zip file contains the evidences and supporting material including the presentation. Password is: "wannacry".

Requirements

  • Basic Windows knowledge (process, file, filesystem, registry)
  • Interest in computer forensics and malware analysis
  • At least one virtualization technology if you want to perform the practical tests (e.g. Virtualbox/VmWare)

Description

Wannacry has been one of the most famous ransomware in computer history (so far) which allows us to investigate how it worked and identify indicators of compromise. The goal of the course is not to protect against Wannacry, but to provide you with a methodology to be able to quickly assess the behavour of a suspicious application in a computer. The tools we are using in this course are free for personal use, but there are way more other solutions you can use for the same purpose.

At the end of this training you will have a solid understanding how the ransomware works and how to protect you environment, also you will be able to use the tools to identify and analyse other malicious tools. You will not be a malware analyst, this is not the course for that. This course will give you the steps to be able to do incident response in a quick manner and see what areas you need to develop yourself using other courses. Deep malware analysis is a very interesting area, but not necessarily the part of the incident response team. There are companies specialized in malware analysis, or people specializing in malware analysis. One can spend hours, days, weeks, months analyzing a single malware. This course aims for quick response.

Who this course is for:

  • People with interest in information security
  • People with interest in incident resposne
  • Security Operations Center team members
  • People interested to start analyzing malware

Report abuse