Welcome today, we're going to mess around with Joe Sandbox the Cloud Basic.
Now,
the sandbox environment provides us a way to actually look at files that we suspect
or URL S that we suspect of having malware or malicious intent behind them.
Now, Joe Sandbox has a free registration that you can go through.
However, you have to have an enterprise
email address associated with it.
The important thing to know for CYS A is what Joe Sandbox actually does,
which was a deep malware analysis of files and URL S.
However, let's take a closer look at it today as we go through it.
Now, not having an enterprise available email address.
If you try to register into it, it's going to ask you for all this great information
and then you have to register it.
Now, I registered on my own account.
However, it still hasn't come in and that was over two weeks ago.
So they are a little bit slow or they
didn't approve my account because of whatever reason.
However, that's ok for what we need to do
CYS A, we can do some basic analysis if you look over here at the very top
hand sign, we could do Windows Mac Android, Linux and advanced
inspection of different malware applications.
We can provide our file and then we can browse the URL if we so choose.
However, like I said, we don't need that for what we can get out of Joe sandbox.
If I hit this little results button right here,
it takes me
to a page that shows me everything that I need to
know about Joe sandbox to pass my cys a exam.
We're just going to grab one of these malicious ones right here.
I'm gonna click on it.
It's going to open up a new page and it's
going to go through and provide me some different information
we can see here that the invoice is paid, it provides us that HTML.
We can see the submission time, we can identify it as an ATM L pusher.
And if I scroll down, I can click the engine as well as the IO CS.
I'm gonna click those IO CS
and you can see that it provides me the IP address associated with the malware.
It also provides me different detection methodologies that
hold as green and green and clean.
So if I click on this, we can identify this as our malicious IP address.
We can identify the different domain specific URL S associated with it
as well as the drop files associated with it.
If I scroll back up and I go back to the engines,
we can see that it has a score of 84 and I can look at the full report,
the management report or the IOC report.
I'm gonna hit the full report because it's gonna provide me everything included.
I can see here that it gives me general information.
The detection algorithm points it as malicious the different
signatures that it's identified as well as the classification.
Now, I love this chart. It provides me a very well detailed synopsis of pointing to
different actions associated with it.
And from here,
I can see that it's clearly a phishing email with a Dab of Trojan in for good measure.
If I scroll down,
I can see here the signatures.
Well, I didn't even come with their signatures but you see the signatures detected.
If I scroll down zo
I can see the process tree again,
more signatures and the specific CSV S associated with it
and some more juicy information
all attributed to this great platform.
I gotta tell you I like and show sandbox. I wish that uh they would provide
the input for more than just a purely enterprise environment.
Uh But it is what it is and there's still a lot of great information there.
I would definitely become equated with it for your cys a exam.
But again,
you don't need to have access to look through the records and that's
what I would utilize just to get a flavor of what's going on
in preparation of your cys a exam. I hope this was helpful.
And next time we'll see you.