Introduction to Windows Malware Techniques & Analysis

Course Description

This is a majority hands-on course providing an in-depth introduction to advanced Windows 10 malware techniques and analysis. This course will teach students to both recognize and implement advanced malware techniques. At the completion of this course, students will have the practical skills needed to analyze sophisticated malware samples.

Prerequisites

  • An understanding of Windows including Windows Internals and Win32 APIs.
  • Programming experience in C, C++, PowerShell, and Python

Required Hardware/Software

Students are expected to supply their own hardware. Computer must have the ability to run a 30GB virtual machine. A recommended hardware configuration would have the following:

  • 50 GB of free hard disk space
  • 16 GB of RAM
  • At least 4 Processor cores
  • VMWare or Virtual Box to import an ova file

Course Schedule:

Day 1- Refresher

  • Windows APIs
  • Windows Internals
  • Windows malware fundamentals

Day 2- Reversing Windows Malware

  • IDA
  • Windbg
  • Reversing Windows Binaries
  • Anti-Debugging Techniques
  • Anti-Analysis Techniques

Day 3- Code Injection Techniques

  • Writing custom shellcode
  • DLL injection
  • Process hollowing
  • Process injection

Day 4- Hooking Techniques

  • API Hooking
  • Trampolines
  • Shellcode for hooking
  • Persistent hooking

Day 5- Windows Driver Rootkits

  • Windows driver refresher
  • Hiding a rootkit or process
  • Protecting from deletion

About Boston Cybernetics Institute

Boston Cybernetics Institute, PBC was created by former MIT Lincoln Lab cybersecurity researchers to give meaningful niche cyber instruction to a new generation of cybersecurity professionals. We avoid the normal style of teaching with PowerPoint and lectures, opting to provide instead real-life engaging instruction that takes place in a customized environment. We have given our style of instruction to multiple DoD agencies, US commercial companies, and international companies.

Instructors at Boston Cybernetics Institute

Jeremy Blackthorne
President of the Boston Cybernetics Institute

Jeremy Blackthorne is a Lead Instructor at the Boston Cybernetics Institute (BCI). Before BCI, he was a researcher in the Cyber System Assessments group at MIT Lincoln Laboratory. Blackthorne is the co-creator and instructor for the Rensselaer Polytechnic Institute (RPI) courses: Modern Binary Exploitation, Spring 2015 and Malware Analysis, Spring 2013.

Jeremy has published research at various academic and industry conferences. He served in the U.S. Marine Corps and is an alumnus of RPISEC. He holds a BS and MS in computer science.

Clark Wood
Security researcher and instructor

Clark Wood is a security researcher and instructor at the Boston Cybernetics Institute (BCI), focusing on Reverse Engineering, Exploitation, and CI/CD. He recently built a Reverse-Engineering and Exploitation platform for a DoD customer and is the Lead Engineer for BCI’s Government Services.

Clark was formerly on the technical staff at MIT Lincoln Laboratory where he was a member of the Cyber System Assessments Group. Clark holds a BA in Economics from the University of Florida, a BS and MS in Computer Science from Florida State University, and a Master’s in Technology and Policy from MIT.

Rodolfo Cuevas
Security researcher and instructor

Rodolfo Cuevas is a security researcher and instructor at BCI, where he focuses on understanding how design constraints can be used to limit the impact of an attacker on a system. His research combines the adversarial mindset with approaches influenced by Systems and Control Theory.

Rodolfo was a staff member at MIT Lincoln Laboratory and began his career as a RADAR and Ballistic Missile Defense System (BMDS) analyst. Later, Rodolfo transitioned to evaluating and Red-Teaming tactical and commercial cyber systems in support of DoD and other government programs. Rodolfo holds a BS, M.Eng., and M.S. in Electrical and Computer Engineering from Cornell University.

Reed Porada
Security researcher and instructor

Reed Porada is a security researcher and instructor at BCI, focused on getting to the "so what" of both defensive and offensive cyber measures. Reed also leads BCI training in Cyber Systems Analysis, focusing on developing systems-thinking skills of developers up to managers.

Reed was a staff member at MIT Lincoln Laboratory for ten years, where he was responsible for Test and Evaluation, Test Automation Research, Red-Teaming of Cyber Systems, and Blue System Architectures. Reed was a computer scientist at the Naval Research Laboratory focused on wireless communication systems. He holds a BS in Computer Science from the University of Maryland, College Park and an MS in Software Engineering from Carnegie Mellon University.

COURSE PRICE

Upon request

COURSE LENGTH:

5 days

What happens after I click the button? Your default e-mail client will pop up and you'll be asked to write us a short message. Please let us know which course you are interested in and what dates would work for you.