root@nikhil:~$ _
Projects Windows Malware Simulation Lab

Windows Malware Simulation Lab

Malware Analysis Completed

Overview

Developed and demonstrated a Windows-based malware simulation capable of collecting host and user information within a controlled cybersecurity lab environment. Demonstrated browser credential and sensitive-data theft by accessing Chrome password stores, cookies, autofill data, browsing history, bookmarks, downloads, and search terms, applying Windows DPAPI and AES-GCM decryption techniques to access locally stored browser secrets as malware running in the victim context would. Demonstrated keystroke logging and command-and-control (C2) data exfiltration, periodically transmitting captured keystrokes and collected system data to a remote webhook. Implemented persistence using the Windows Registry Run key to simulate malware surviving system restarts, and defense evasion techniques including temporary Windows Defender disabling and execution through a trusted Windows process (MSBuild) to blend in with legitimate activity. Analysed the full attack chain from initial execution through persistence, credential/data collection, and C2 exfiltration, applying practical offensive-security and malware-analysis concepts to inform detection and hardening strategies.

Key Features

  • ▸ Host and user information collection within a controlled lab environment
  • ▸ Browser credential theft: Chrome password stores, cookies, autofill, history, bookmarks, downloads, and search terms
  • ▸ Windows DPAPI + AES-GCM decryption of locally stored browser secrets
  • ▸ Keystroke logging with periodic C2 exfiltration to a remote webhook
  • ▸ Persistence via Windows Registry Run key
  • ▸ Defense evasion: temporary Windows Defender disabling and execution via trusted process (MSBuild)
  • ▸ Full attack-chain analysis: execution → persistence → collection → exfiltration