Badasschallenge.exe

: When run without flags, it captures a "Baseline" state and then applies "CurrentState" modifications to the system.

: Run the executable to trigger the simulated "attack." Endpoint Analysis : Identify the new registry key and its associated values. BadassChallenge.exe

: The service is often configured with a specific START_TYPE (e.g., Automatic or Manual) to dictate how it launches upon system boot. Analysis Steps : When run without flags, it captures a

This write-up covers the analysis of , a simulated malware sample often used in cybersecurity endpoint analysis training to demonstrate persistence mechanisms and service manipulation on Windows systems. Analysis Steps This write-up covers the analysis of

: Use a script or monitoring tool to document the system state before running the .exe .

: It installs a new Windows service. To analyze this, you can check the ImagePath value in the registry, which reveals the full file path the service binary points to.

🧪 Windows Endpoint Analysis Challenge 1 (studyLog) | by labbrattyrat