NWPU Access control Policy and Procedures in Government AgencyPPT Computer Science Assignment Help

Please submit the following assignment prior to Sunday at 11:59 pm. Eastern time:

1. Using a Microsoft Word document, please post one federal and one state statute utilizing standard legal notation.

2. In the same document, please post one federal and one state case using standard legal notation.

Sample document:

Assignment 4 response

Federal Statute

Computer Fraud and Abuse Act

18 U.S. Code § 1030

State Statute

Kentucky Murder Statute Citation: KRS 507.027

Federal Case

Supreme Court Case on death penalty

Stanford v. Kentucky, 492 U.S. 361 (1989)

State Case

Kentucky Supreme Court Case on Custody

Squires v. Squires 854 S.W.2d 765 (1993)

I’m a construction and technology management graduate student and this class is a “Technological system, assessment, and innovation class.

Question:

The world is currently going through COVID19 pandemic that has changed many things around us. Assuming that you have the ability to turn back the clock to January 2019 with the knowledge of the possibility of a catastrophic event is coming, please explore what the world generally and the US specifically could have done in preparation for a risky event like COVID19 (at that time, we did not know about COVID19). Please explore this question through the lenses of risk management, ethics, technology, entrepreneurship, and your own firm.

I have also attached a sample essay of what is expected in this paper. Please us the same formatting and paper length as the sample paper.

The actual writing: Please write a 4-5 page paper (see format details below) that describes the main ideas of the article. Be sure you include a section that describes what you learned that you did not know, what surprised you, and how this article connects or relates to some aspect of your life or that of someone you know. You can use hypothetical situations (e.g., if I had no toes…).

Format for assignment paper must be typed neatly and contain no misspelled words, typos, or grammatical errors. Assignments must be double-spaced (no extra spaces/lines between paragraphs) using 1″ margins, use New Times Roman font (12 cpi). Number the pages on the top right please. Start on Page 1 – no need for a title page. Be sure your name, date, and the title of the assignment are on your work. If your assignment is shorter than 4 entire pages, it is too short, and points will be deducted).

I post the articles in pdf.

1-However opening the file is Cerbero Profiler highlights that the file contains a binary resource which has a MZ header (executable). Let’s extract the resource and re-analyze it with virus total and PEID.

2-As of 25th Jan 2016 there were 45/53 anti virus detection ratio for resource.exe.

3-PEID did not suggest that the extracted binary is packed. IDA Pro’s imports table looks legitimate as well.

To answer when is the binary compiled we can use Cerbero Profiler again to check.

4-From the above we can see that Lab01-04.exe compile date/time is fake. But the resource binary’s datetime stamp might be the real deal.

5-The ADVAPI32 Library allows us to gain higher privileges so as to facilitate in some of the functions call later. Kernel32 Library in this case allows us to loadlibrary, execute application, write file to disk and access resources.

6-The above screenshot shows that the malware is attempting to increase its privileges to SeDebugPrivilige. Once adjusted, it begin calling sfc_os.dll’s 2nd ordinal function which is the CloseFileMapEnumeration function.

7-We can find out more details in what this function can do here… in a nut shell, it is trying to disable the write protection that winlogon is providing. Once the protection is disabled, the malware then move the file “windows directorysystem32wupdmgr.exe” to “tempwinup.exe”. It then read its own resource @ #101 and write it out as a file at “windows directorysystem32wupdmgr.exe”. The malware then executes this freshly written binary using WinExec.

8-There are only 4 imports of interest here.

URLDownloadToFileA; downloads a file from a given url to the victim’s machine

GetWindowsDirectoryA; get the windows directory of the victim’s machine

GetTempPathA; get the path of the directory designated for temporary files

WinExec; run command/application

From the above import functions, we can make an educated guess that the malware is attempting to download another binary from a URL into either the victim’s temp directory or windows directory and execute it.

9-the disassembled code simply executes an exe located in “temppathwinup.exe” where temppath refers to the temporary folder specified in the environment variables. It then attempts to download another exe from http://www.practicalmalwareanalysis.com/updater.ex… and save it in “windows directorysystem32wupdmgrd.exe”. It then executes this exe via winExec.

10-Solutions to question 4 and 5 would have answered this question. A lot of malwares uses these techniques to drop malicious executables on the victim’s machine. there are various form of payload hidden in the dropper. Some are in the form of images (hidden via stengo) while some are just purely address offsets. Encryption/Encoding such as Rc4/XOR/Base64 is commonly used in droppers as well. What is interesting in this exercise is probably the technique to disable windows file protection using user code.