Guided Capstone Overview

Guided Capstone Overview

What this path assumes. A capstone integrates the earlier paths rather than teaching new material: static triage (A2), dynamic analysis (A3/D1), and whichever of the specialist paths the case touches. The first capstone module is free so you can see the shape of the work, but if a step assumes a tool you have not met yet, the module that teaches it is linked from the step.

This capstone exercise integrates every skill you have developed throughout the Malware Analysis Academy. You will analyze a complete malware sample from initial triage through final reporting, following the same end-to-end methodology used by professional incident responders and malware analysts in real-world engagements.

Why a Guided Capstone Matters

In the field, you rarely encounter malware one technique at a time. Real samples combine packers, anti-analysis tricks, network callbacks, persistence mechanisms, and payload delivery into a single artifact. The guided capstone bridges the gap between isolated lab exercises and the complexity of genuine incidents.

The guidance provided here acts as scaffolding: it tells you what to investigate at each stage but expects you to decide how to investigate it, which tools to select, and how to interpret results. This mirrors junior analyst onboarding, where a senior team member sets direction while the new analyst executes.

Capstone Objectives

By the end of this exercise, you will be able to:

• Apply the full triage-to-report analysis methodology against an unknown sample
• Make defensible tool selection decisions at each analysis phase
• Identify and work around anti-analysis and self-defending techniques
• Produce a complete, professional-grade analysis report
• Map observed behaviors to the MITRE ATT&CK framework with supporting evidence
• Extract actionable indicators of compromise (IOCs) for detection engineering

The Analysis Methodology: End-to-End

The methodology follows a structured escalation from least-invasive to most-invasive analysis. Each phase builds on the previous one, and you should only escalate when you have exhausted what the current phase can tell you.

Pro Tip: The time budgets above are guidelines for this capstone. In a real incident, time pressure varies, but the principle of diminishing returns applies universally. If you have spent 30 minutes on static analysis without new insights, move to dynamic analysis.

Phase 1: Triage -- First Contact with the Sample

Triage is about answering three fundamental questions as quickly as possible:

1. What is this file? (file type, architecture, compiler)
2. Has anyone seen it before? (hash lookups, AV detection)
3. How dangerous is it likely to be? (packer detection, suspicious indicators)

Step-by-Step Triage Workflow

Step 1: Compute and record cryptographic hashes

# Generate hashes for identification and chain-of-custody
sha256sum suspect.exe
md5sum suspect.exe
sha1sum suspect.exe

Expected output pattern:

a1b2c3d4e5f6...  suspect.exe

Record all three hashes in your notes immediately. The SHA-256 is your primary identifier; MD5 and SHA-1 are for compatibility with older systems and databases.

Step 2: Identify the file type

file suspect.exe
# Expected: PE32 executable (GUI) Intel 80386, for MS Windows

Check whether the file command output matches the extension. A .exe file identified as a ZIP archive, PDF, or script is immediately suspicious and may indicate a polyglot file or a disguised payload.

Step 3: Check for packers and protectors

Open the sample in Detect It Easy (DIE) or PeStudio. Look for:

• Known packer signatures (UPX, Themida, VMProtect, custom packers)
• Entropy values above 7.0 in any PE section (suggests compression or encryption)
• Mismatched section names (e.g., UPX0, UPX1, or randomized names)
• A minimal Import Address Table with only LoadLibraryA and GetProcAddress

# Quick entropy check via command line
python3 -c "
import math, collections, sys
data = open(sys.argv[1], 'rb').read()
freq = collections.Counter(data)
entropy = -sum((c/len(data)) * math.log2(c/len(data)) for c in freq.values())
print(f'Overall entropy: {entropy:.2f}')
" suspect.exe

Step 4: Consult threat intelligence sources

Submit the SHA-256 hash (never the sample itself during a live incident, unless policy permits) to VirusTotal or similar platforms. Note:

• Detection ratio and family names
• First-seen and last-seen dates
• Community comments and tags
• Behavioral analysis results if available

Phase 2-4: Analysis Phases (Detailed in Next Lesson)

The subsequent lesson covers the detailed workflow for static analysis, dynamic analysis, and targeted reverse engineering, along with the complete reporting template.

Success Criteria for the Capstone

Your analysis will be evaluated against these professional standards:

What "Reproducible" Means in Practice

Reproducibility means documenting not just your conclusions but the exact commands, tool versions, filter settings, and environmental conditions. For example:

• Weak: "The sample contacts a C2 server."
• Strong: "Wireshark capture (pcap: analysis-20250302.pcapng, filter: ip.addr==192.168.x.x) shows the sample initiating a TCP connection to 185.x.x.x:443 at T+12 seconds after execution. The TLS ClientHello SNI field contains 'update.evil-domain[.]com'."

Common Pitfalls to Avoid

1. Skipping triage and jumping straight to dynamic analysis -- You may miss important static indicators and waste time on a known sample.
2. Running the sample before configuring monitoring tools -- Always start Procmon, Wireshark, and FakeNet-NG before executing the sample.
3. Failing to snapshot your VM -- If the sample corrupts your analysis environment, you lose everything. Snapshot before every execution.
4. Over-investing in reverse engineering -- Deep RE is only justified when static and dynamic analysis leave critical questions unanswered. Budget your time.
5. Treating anti-analysis failures as dead ends -- If the sample detects your debugger or sandbox, this is itself a finding. Document the anti-analysis technique and adapt your approach.

Setting Up Your Analysis Environment

Before you begin, verify your environment is properly configured:

• Windows analysis VM is snapshot-ready (clean state)
• REMnux VM is running and network-accessible for FakeNet-NG
• Procmon is installed and tested
• Wireshark is capturing on the correct interface
• FakeNet-NG is configured to intercept DNS and HTTP/HTTPS
• Regshot has taken a first baseline snapshot
• Your notes document (Markdown, OneNote, or equivalent) is open with timestamps enabled
• All tools are updated to current versions

Important: Never analyze malware on your host system. Always use isolated virtual machines with network controls in place.