Cloud Computing using Wireshark...Cryptolocker Activity

A crime has been suspected around Cryptolocker activity, and the incident response team have captured evidence related to the suspected crime. It is thus your objective to investigate the virtual image, and produce a fair and unbiased report on the findings. The analysis should involve analysing the network trace for the connections from the hosts which connected to the host-under-suspicion (HUS). Along with this you should analyse and cross-correlate the activity within the logs on the HUS, and the trace of files left on the system. Evidence should also be gained from the applications which were used within the time window of interest. Please note that all other activity outside this window-of-interest should be ignored. There are multiple communications within the network trace, some of which have possible malicious intent, and others which are normal non-malicious content. As part of the analysis you should: • In the report, define a strict methodology that you would apply in actually undertaking the investigation. • Take reasoned judgments as to the nature of the trace of network activity. • Where faced with suspect content, try to uncover the root of the evidence, such as cracking cipher codes. The methods tried should be clearly defined in the report. • Define the timeline of activity involved in the possible malicious activity. • Cross-corroborate the network traces with the system traces that appear on the host system (such as examining system logs, audit logs, and the file attributes), and report on any suspicious activities. Note: Virtual images will be provided to you once the project been agreed or awarded.