Project 74: Malware Analysis Lab

Module: Module 8: Exploit Development & Malware Fundamentals  |  Level: Advanced  | 
Primary tool: Any.Run (free sandbox tier) or a local isolated VM + Process Monitor  |  Estimated time: 2–4 hours

Objective: Perform behavioral analysis of a known malware sample safely.

Free lab environment

MalwareBazaar (abuse.ch) + a fully offline analysis VM — https://bazaar.abuse.ch/

MalwareBazaar is a free, legitimate malware-sample repository run by abuse.ch for researchers and defenders. Only ever detonate or inspect samples inside a fully network-isolated virtual machine (host-only or no networking, snapshot taken beforehand) that you are prepared to destroy afterward. Never run a live sample on your host OS or a network-connected VM.

Lab workflow

1. Before anything else: confirm your analysis environment has no real network access and is a disposable snapshot you are prepared to destroy afterward. Do not proceed until this is true.
2. Obtain your sample from a sample from MalwareBazaar, analyzed only inside Any.Run’s free cloud sandbox or a fully isolated local VM — a legitimate, purpose-built research source, never a random internet download.
3. Using Any.Run (free sandbox tier) or a local isolated VM + Process Monitor, perform your analysis with the specific goal of learning to perform behavioral analysis of a known malware sample safely.
4. Record every observable indicator of compromise (IOC) as you find it: file paths, registry keys, network callbacks, process names.
5. Summarize the sample’s behavior in plain English, as if briefing someone who cannot read the raw tool output themselves.
6. Destroy or revert the VM snapshot once you have exported your evidence — don’t leave a live sample sitting in a running environment.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• the sandbox’s process-tree/behavior summary for the sample
• your written IOC list (files written, registry keys, network callbacks) extracted from the run

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.