public/subjects/cybersecurity/mal-track/audit

General

Is the student able to explain clearly how we can manage the startup programs in windows?

Is the student able to explain clearly how he get the ip of the attacker from the malware?

Is the student able to explain clearly how his program works?

Files that must be inside your repository:

• Your program source code.

• a README.md file, Which clearly explains how to use the program.

Are the required files present?

Evaluate the student's submission

Create a Windows virtual machine

Add mal-track.exe to anti-virus exceptions

Launch the mal-track.exe program

Does it exist in the task manager?

Launch the student program

Does the program developed by the student kill the malware process.

Open task manager CTRL+ALT+DEL or Windows key+R -> msconfig.

Has mal-track.exe been killed from task manager?

Does the program developed by the student removes our malware from the start of the machine?

Open Registry Editor Windows key+R -> regedit

Is maltrack not located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run?

Is maltrack not located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce?

Is maltrack not located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run?

Is maltrack not located in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce?

The attacker's IP address is "127.0.0.1"

Does the student program display the attacker's IP address?

Can the student trace the IP address of the attacker manually with an hexadecimal editor?