Assignment
In this assignment you will be asked to review network traffic by means of a PCAP file and create a report. This report will be presented to upper management to inform them of the incident. Upper management are non-technical users, so ensure the report does not drift off into tech-talk. Keep the report concise, easy to understand. and to the point.
Your report should contain the following:
a) Date and time of the activity [in GMT or LITCII
b) The account name or username from the infected Windows computer
c) The host name oi the infected Windows computer
d) The MAC address oi the infected Windows computer
e) SHRA256 tile hashes for any malware from the pcap
f) What type of infection this is
Here are some specific questions to help you get the information needed for the report {Put your answers in the form of a report]:
a) What time in UTC does the malicious traffic start?
b) What is the Windows account name from the infected Windows computer?
c) What is the host name of the infected Windows computer?
d) What is the MAC address of the infected Windows computer?
e) What is the SHA256 file hash for the one malware {a Windows executable} you can extract from the pcap?
f) What type of infection is this?