{"id":124,"date":"2015-08-18T13:54:33","date_gmt":"2015-08-18T12:54:33","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=124"},"modified":"2016-02-23T21:55:14","modified_gmt":"2016-02-23T21:55:14","slug":"malware-exercise-2015-08-07-someone-was-fooled-by-a-malicious-email","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=124","title":{"rendered":"Malware Exercise 2015-08-07 – Someone was fooled by a malicious email"},"content":{"rendered":"

Prologue about this and future “Malware Excercise” posts<\/h3>\n

I have been wanting to blog about my experiences playing with malware and trying to figure out how they work, techniques that helped me dissect them, tools that I used, etc… but never really had the chance\/time to sit down and do it outside of work. Since Security Researcher Brad Duncan (follow him on Twitter<\/a> or via his site at Malware Traffic Analysis<\/a>) has started to do lab exercises for other researchers\/analysts I figured that it would be a good way of killing two birds with one stone (doing the exercise and writing about it). So with that being said, I will take what I have gathered from the lab exercises and use that as my blog posts to document how I found things, tools used, etc… For more information about the exercises that Brad has on his site, you can click here<\/a>. <\/span><\/p>\n

Stupid emails!<\/h3>\n

TL;DR – In this exercise a user got an email and proceeded to get compromised from it. The end-goal is to figure out which email, and develop a time-line of events from the artifacts found.<\/p>\n

My Results<\/h3>\n