Welcome.
Today we're going to mess around with Joe Sandbox the cloud basic.
Now the sandbox environment provides us a way to actually look at files that we suspect, or URLs that
we suspect of having malware or malicious intent behind them.
Now, Joe Sandbox has a free registration that you can go through.
However, you have to have an enterprise email address associated with it.
The important thing to know for Cisa is what Joe Sandbox actually does, which was a deep malware analysis
of files and URLs.
However, let's take a closer look at it today as we go through it now not having an enterprise available
email address.
If you try to register into it, it's going to ask you for all this great information and then you have
to register it now.
I registered on my own account.
However, it still hasn't come in and that was over two weeks ago.
So they are a little bit slow or they didn't approve my account because of whatever reason.
However, that's okay for what we need to do for Sisa.
We can do some basic analysis.
If you look over here at the very top hand sign, we can do windows, Mac, Android, Linux, and advanced
inspection of different malware applications.
And we can provide our file and then we can browse the URL if we so choose.
However, like I said, we don't need that for what we can get out of Joe Sandbox.
If I hit this little results button right here, it takes me to a page that shows me everything that
I need to know about Joe Sandbox to pass my Cisa exam.
We're just going to grab one of these malicious ones right here.
I'm going to click on it.
It's going to open up a new page.
And it's going to go through and provide me some different information.
We can see here that the invoice is paid.
It provides us that HTML code.
We can see the submission time.
We can identify it as an HTML publisher, and if I scroll down, I can click the engine as well as the
IOCs.
I'm going to click those IOCs, and you can see that it provides me the IP address associated with the
malware.
It also provides many different detection methodologies that is green and green and clean.
So if I click on this we can identify this as our malicious IP address.
We can identify the different domain, the specific URLs associated with it as well as the drop files
associated with it.
If I scroll back up and I go back to the engines, we can see that it has a score of 84.
And I can look at the full report, the management report or the IOC report.
I'm going to hit the full report because that's going to provide me everything included.
I can see here that it gives me general information.
The detection algorithm points it as malicious.
The different signatures that it's identified as well as the classification.
Now I love this chart.
It provides me a very well detailed synopsis of pointing to the different actions associated with it.
And from here I can see that it's clearly a phishing email with a dab of Trojan in for good measure.
If I scroll down, I can see here the signatures.
Well, I didn't even come with their signatures.
But you see the signatures detected.
If I scroll down some more, I can see the process tree again.
More signatures and the specific csvs associated with it, and some more juicy information, all attributed
to this great platform.
I gotta tell you, I like Joe Sandbox.
I wish that they would provide the input for more than just a purely enterprise environment, but it
is what it is and there's still a lot of great information there.
I would definitely become acquainted with it for your CSA exam, but again, you don't need to have
access to look through the records.
And that's what I would utilize just to get a flavor of what's going on in preparation of your CSA exam.
I hope this was helpful.
And next time we'll see you.